Identifying which parts of a token impact the response with Burp Suite - Port Swigger
Summary: PortSwigger describes using Burp Intruder's Character frobber and Bit flipper payload types to modify each character or bit position of a token in turn, so testers can identify which parts of the token affect the response. The guidance notes that if a character change in a session token still returns a processed request, that character likely is not used to track the session, and that tokens with CBC-encrypted data should use Bit flipper to modify bits in the preceding cipher block.
Bottom line: A token whose integrity checks only cover part of its value leaves the rest open to tampering, so knowing which characters or bits the application actually reads is the difference between a session you can forge and one you cannot.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026