Burp Intruder payload types - Port Swigger
Summary: PortSwigger's documentation for Burp Intruder describes the payload types the tool can inject into a base request, from simple wordlists and runtime file reads to custom iterators that permute up to eight template positions and character substitution rules that turn "peter" into variants like "p3t3r". It also covers recursive grep payloads that pull text from a prior response into the next request, illegal Unicode encodings for filter bypass, and bit flippers for testing CBC-mode encrypted values.
Why it matters: The recursive grep type requires a resource pool capped at one concurrent request, and the numeric generator warns of precision loss past roughly 12 digits because Burp uses double-precision floats - details that decide whether an automated attack returns clean data or quietly wrong results.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026