Real-World Testing Scenarios

Examples

Step-by-step testing scenarios covering the most common web vulnerabilities. Each example shows exactly how to configure Burp tools (Repeater, Intruder, Scanner) to find and verify security issues.

Practice these on intentionally vulnerable applications like WebGoat, DVWA, or HackTheBox web challenges.

1

SQL Injection Detection

Sniper

Use Repeater to inject SQL payloads and observe error messages or boolean-based content differences.

Steps

  1. 1.Intercept login request → Send to Repeater
  2. 2.Inject ' OR 1=1 -- into username field
  3. 3.Send request and check: does response differ? Does login succeed without valid credentials?
  4. 4.Try UNION-based: ' UNION SELECT null,null,username,password FROM users --
  5. 5.Check if database content appears in response

Example Payload

bash
1' OR '1'='1' --
2

Cross-Site Scripting (XSS)

Sniper

Inject JavaScript and check if payload is reflected and executed in browser context.

Steps

  1. 1.Find a search box or comment form
  2. 2.Send to Repeater → Inject <script>alert(1)</script>
  3. 3.Send and observe: does script tag appear in response body?
  4. 4.If filtered, try encoding: <ScRiPt>, %3Cscript%3E, etc.
  5. 5.For stored XSS, trigger the stored content in another browser session

Example Payload

bash
1<script>alert(document.cookie)</script>
3

Insecure Direct Object Reference (IDOR)

Sniper

Test horizontal/vertical privilege escalation by modifying resource identifiers.

Steps

  1. 1.Login as user A (e.g., /account/1000)
  2. 2.Note your user ID from response (or session cookie)
  3. 3.Send account request to Repeater → manually change ID to 1001 (user B)
  4. 4.Send and check: does response contain user B data?
  5. 5.Repeat for all numeric IDs, GUIDs, file paths

Example Payload

bash
1/order/12345 → /order/12346
4

Path Traversal

Sniper

Traverse directory structure to read sensitive files outside web root.

Steps

  1. 1.Identify file-loading parameter: ?file=report.pdf
  2. 2.Replace with traversal: ../../../etc/passwd
  3. 3.If blocked, double-encode: ..%2F..%2F..%2Fetc%2Fpasswd
  4. 4.Test variations: ....//, %c0%ae, etc. for bypasses
  5. 5.Look for Unix (/etc/passwd) or Windows (C:\Windows) files

Example Payload

bash
1../../../etc/passwd
5

SSRF (Server-Side Request Forgery)

Sniper

Make server send requests to attacker-controlled host to detect SSRF.

Steps

  1. 1.Find URL parameter: ?url=http://internal-server/api
  2. 2.Replace with Collaborator domain: http://abcd1234.burpcollaborator.net
  3. 3.Send request → check Collaborator for DNS/HTTP callback
  4. 4.If blocked, try DNS rebinding, redirect chains, or different protocols

Example Payload

bash
1http://burpcollaborator.net
6

Command Injection

Sniper

Inject OS commands into parameters that interact with system.

Steps

  1. 1.Test command separation: ; id, || id, & id
  2. 2.Test command substitution: $(id), `id`
  3. 3.Check response for command output (uid, gid, username)
  4. 4.If blind, use time-based: ; sleep 5 — does response delay 5 seconds?
  5. 5.Out-of-band: ; nslookup attacker.com to get DNS callback

Example Payload

bash
1; cat /etc/passwd
7

Brute Force Login with Intruder

Cluster Bomb

Use Cluster Bomb to try username+password combinations.

Steps

  1. 1.Capture login POST request → Send to Intruder
  2. 2.Mark username and password fields as §positions§
  3. 3.Set attack type: Cluster Bomb
  4. 4.Payload set 1: usernames.txt (e.g., admin, root, user)
  5. 5.Payload set 2: passwords.txt (e.g., password123, admin123)
  6. 6.Start attack → filter results by response length/login success message
8

Directory Traversal with Intruder

Sniper

Fuzz for sensitive files by iterating through common paths.

Steps

  1. 1.Find file parameter: ?page=home.html
  2. 2.Send to Intruder → mark page parameter
  3. 3.Attack type: Sniper
  4. 4.Payload: SecLists/Fuzzing/LFI/common.txt or custom path list
  5. 5.Look for 200 OK vs 404, content-length changes, server errors
9

API Parameter Mining with Param Miner

Extension-based fuzzing

Discover hidden API parameters that modify application behavior.

Steps

  1. 1.Install Param Miner extension
  2. 2.Send a valid API request to Repeater
  3. 3.Right-click → "Param miner" → "Discover parameters"
  4. 4.Load wordlist: params.txt (common param names)
  5. 5.Observe which added parameters change response (non-404)
  6. 6.Test discovered parameters for injection
10

JWT Token Tampering

Modify JWT claims to escalate privileges or bypass authentication.

Steps

  1. 1.Capture JWT from Authorization header
  2. 2.Send to Decoder → Base64 decode payload
  3. 3.Modify claims: {"role":"user"} → {"role":"admin"}
  4. 4.Base64 encode modified payload
  5. 5.If signature fails, try "none" algorithm or brute-force weak secret
  6. 6.Send modified token to server with JWT Editor extension
11

XXE (XML External Entity) Injection

Sniper

Inject external entity definitions to read files or cause SSRF.

Steps

  1. 1.Find XML input (SOAP API, file upload with XML, Content-Type: application/xml)
  2. 2.Inject XXE payload: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
  3. 3.Send and check if file contents appear in response
  4. 4.For blind XXE, use Collaborator DNS: <!ENTITY xxe SYSTEM "http://burpcollaborator.net">

Example Payload

bash
1XXE payload above
12

CSRF Token Bypass

Repeater replay

Test if CSRF token is validated properly by removing or reusing tokens.

Steps

  1. 1.Capture a legitimate request with CSRF token
  2. 2.Replay request with token removed or with old token
  3. 3.If server accepts, CSRF protection is broken
  4. 4.Also test: remove entire Referer header; change Origin header

How to Practice for Real

Set up a safe environment to practice these attacks without harming real systems:

DVWA (Damn Vulnerable Web App)

PHP/MySQL vulnerable app covering XSS, SQLi, CSRF, LFI, command execution.

WebGoat

OWASP-maintained insecure Java app with dozens of lessons.

bWAPP

Buggy web application with 100+ vulnerabilities. Includes all OWASP Top 10.

HackTheBox (Web Challenges)

Online CTF platform with live web machines. Range: easy to insane.

TryHackMe

Guided rooms and CTFs. Includes complete Burp Suite walkthroughs.

PortSwigger Web Security Academy

Free, official Burp Suite practice labs — the best place to start.

Warning

Only test on systems you own or have explicit permission to test. Unauthorized penetration testing is illegal.
Next: Pro Tips Back