Evaluating inputs with Burp Suite - Port Swigger
Summary: PortSwigger's tutorial describes using Burp Suite's Repeater, Comparer, Scanner, and Intruder tools to evaluate user-controllable inputs after functionality worth investigating is found, with the goal of determining which inputs matter most to an application's function, such as those affecting session or state. It walks through modifying inputs one at a time in Repeater, sending responses to Comparer to spot subtle differences, scanning single or multiple inputs with Burp Scanner in Professional, and fuzzing inputs in Intruder, using a SQL injection lab as the example.
Key Takeaway: The method depends on a human deciding which inputs are worth testing and then comparing responses closely enough to catch subtle differences, so the inputs that never get selected are the ones that go unexamined.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026