Intruder
Intruder is Burp Suite's automated attack engine. It takes a base HTTP request, marks specific positions as attack points (parameters, headers, paths), and iterates through wordlists or generated payloads at those positions. Intruder supports four attack types, each suited to a different scenario.
Community edition throttles Intruder to ~1 request/second. Use Turbo Intruder extension for high-speed attacks (thousands/sec).
Attack Types
Choosing the right attack type controls how payloads map to attack positions:
Sniper
One payload set → Position 1: [id=1] onlyIterates through a single payload set, attacking one position at a time. Most efficient for testing a single parameter.
Use case: Fuzzing one username field with 1000 passwords
Best for: Parameter fuzzing, directory traversal, file inclusion, LFI/RFI, single-field injection
Speed: Fastest for single-parameter testing
Battering Ram
One payload set → Positions 1&2: both get "admin"Uses the same payload across all defined positions simultaneously. Good for testing when username=password pattern is used.
Use case: Testing if username == password across both fields
Best for: Credential stuffing where same password used for multiple fields, testing symmetric parameters
Speed: fast, but limited scope
Pitchfork
Set1 (usernames) + Set2 (passwords) → (user1, pass1), (user2, pass2)...Multiple independent payload sets. Each position gets its own payload set. All payloads iterate in parallel (zipper-style).
Use case: Username list + Password list pairs: (alice,Pass123), (bob,Secret456)
Best for: Username+password combos, replacing multiple related parameters at once, multivalued attacks
Speed: Medium — each payload set must have same length
Cluster Bomb
Set1 (10) × Set2 (100) = 1,000 combosMultiple payload sets. Tests every possible combination across all positions (cartesian product). Can generate massive request counts.
Use case: 10 usernames × 100 passwords = 1,000 total requests
Best for: Brute-force login forms, exhaustive enumeration, when you need to try all combos
Speed: Slowest — combinatorial explosion
Setting Up an Intruder Attack
1. Set target scope
Go to Target tab and define the scope (hosts, paths) to keep attacks focused.
2. Send request to Intruder
From Proxy history or Repeater, right-click request → Send to Intruder.
3. Set attack type
Intruder window opens. Choose attack type: Sniper, Battering Ram, Pitchfork, or Cluster Bomb.
4. Mark attack positions
In request editor, highlight parameter values or headers you want to fuzz. Click "Add §".
5. Configure payloads
Go to Payloads tab. Choose payload type (simple list, numbers, dates, brute force, file). Load wordlist or generate.
6. Set payload processing
Optionally apply rules: URL-encode, HTML-encode, regex replace, trim, etc.
7. Start attack
Click "Start attack". Results appear in a sortable table with length, status, error count.
8. Analyze results
Sort by response length or status code differences to find anomalies indicating vulnerability.
Tip
Payload Types
Intruder offers many payload types beyond simple wordlists:
Simple list
Load from file or paste list. Most common — usernames, passwords, paths.
Numbers
Generate numeric sequences: start-end, range, increment.
Dates
Generate dates within a range with various formats.
Brute force
Character-set-based brute force for short strings.
Character substitution
Apply substitutions like a→@, e→3, s→$.
Case mutation
Toggle case: lower, upper, capitalize, random.
Recursive grep
Parse responses and extract values for next attack stage.
Runtime file
Read payloads from file that updates during attack (for dynamic lists).
Character blocks
Insert specific character sequences at marked positions.
Payload Processing Rules
Transform payloads on-the-fly before they are sent. Useful for encoding, hashing, or adding prefixes/suffixes.
Warning
Grep — Match Results
The Grep tab lets you flag interesting responses based on:
Tip