Comparer
Comparer is Burp Suite's side-by-side visual diff tool. You paste or send two pieces of data (requests, responses, or any text) and it highlights every difference — word-level and byte-level. This is essential for detecting subtle variances that indicate a vulnerability.
How to Use Comparer
Method 1: Send from other tools
From Proxy history, Repeater, or Scanner results: right-click two items (hold Ctrl to select both) → "Compare".
Method 2: Copy & paste
Open Comparer tab (Window → Comparer) → paste Left text, then paste Right text → Compare.
Comparison types
Word diff (semantic) or byte diff (binary-level) — switch between the two depending on the data type.
Comparison Modes
Comparer offers two diff algorithms:
Words
Tokenizes text into words (separated by whitespace/punctuation). Best for comparing HTML, JSON, XML, or human-readable content.
Compare two HTML responses to see which elements differ.
Bytes
Binary-level byte comparison. Shows exact byte-by-byte differences. Best for binary data, hashes, or Base64 blobs.
Compare two hashes or encrypted tokens to spot one-byte variance.
Common Vulnerability Detection Scenarios
Use Comparer to confirm vulnerability by comparing responses:
SQL Injection Error Detection
Compare a normal response to one after injecting a single quote to spot database error differences.
Example: Normal vs. WHEN 1=1 vs. WHEN 1=2 — look for length or content changes
Authentication Bypass
Compare authenticated vs. unauthenticated responses to identify protected resources.
Example: Request as guest vs. logged-in admin — highlight differences in content
Blind Boolean-based Injection
Compare two payloads (TRUE condition vs. FALSE condition) to find subtle timing or content length differences.
Example: id=1 AND 1=1 vs. id=1 AND 1=2 — 1 char difference might indicate injection
IDOR Detection
Compare response of user A accessing their own resource vs. user A accessing user B resource.
Example: User1 /account/1234 vs User1 /account/5678 — differences indicate access control
Comparing Requests vs Responses
Comparer helps detect vulnerabilities by showing differences:
Compare two responses
Find injection success by comparing normal vs. payloaded response.
Compare request/response
Check if request modifications are reflected in the response as expected.
Compare multiple responses
Send same request with different inputs — differences may leak data.
Compare raw vs hex
Detect hidden null bytes or encoding issues invisible in raw view.
Reading the Diff
Comparer highlights changes with color coding:
Red highlight
Content present on left but missing on right (deletion)
Green highlight
Content present on right but not on left (addition)
Yellow/amber
Content modified (both sides different)
Tip