20 Burp Suite tips from the Burp user community
Summary: PortSwigger collected 20 Burp Suite tips from a community tweet thread started by longtime Burp Suite Professional user Michael Skelton (@codingo_), covering shortcuts, default project options, match-and-replace rules, and proxy listener setups. The tips include sending requests from HTTP History to Repeater with Ctrl+R and jumping to Repeater with Ctrl+Shift+R, building a default_project_options.json to avoid repeating configuration, and using match-and-replace to inject XSS polyglots or cache poisoning headers like X-Forwarded-Host.
What's compelling: The tips are workflow shortcuts for pentesters, but several - match-and-replace rules that rewrite values on every request, and a second chained Burp instance used to swap in another user's cookies or CSRF tokens - are exactly the kinds of test-time manipulation that can alter production traffic if scope and targets are not tightly controlled.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026