Pro Tips

Define scope before testing. Prevents accidental testing of unauthorized hosts, keeps your project organized, and speeds up scans. Scope also enables "Scope-aware" tools to only attack in-scope targets.

Passive scan runs automatically on all proxied traffic. Let it gather information before you start manual testing — it flags low-hanging fruit like missing headers, informational disclosures, and weak SSL settings.

Community edition throttles Intruder to ~1 request/second. For high-speed attacks, use Turbo Intruder extension (bypasses throttle) or upgrade to Professional edition.

In Intruder and Repeater, enable "Follow redirects" only when needed. Following every redirect adds noise and slows attacks. Disable it when testing a single endpoint.

Cracking or brute-forcing sessions can run for hours. Save your project (File → Save) regularly. You can also save Intruder results mid-attack and resume later.

Out-of-band (OAST) vulnerabilities like blind SSRF, XXE, and command injection call back to your server. Configure Collaborator (Pro) or use Burp Collaborator public server to catch callbacks.

Use HTTP history filter bar to narrow by MIME type, status code, or search keywords. This helps you find API endpoints (JSON), admin pages, or interesting parameters quickly.

Right-click request context menu: Send to Repeater (manual test), Send to Intruder (fuzzing), Send to Scanner (automated), Send to Comparer (diff). Each has its purpose.

Proxy → Options → Match and Replace. Automatically modify requests/responses on-the-fly — remove security tokens, normalize headers, bypass client-side checks.

When spidering, turn intercept OFF. Otherwise every single crawled request gets stuck in Intercept tab and you must manually forward them all.

Save project options (proxy, scanner, intruder) as templates for frequent targets. Load them quickly instead of reconfiguring each time.

Some extensions (Turbo Intruder, Logger++) require their own configuration. Check the extension tab after installing to ensure they are set up correctly.

Pro users can define session handling rules to automatically refresh expired sessions, retry after logout, or use different credentials per scope.

Use Comparer to diff a baseline request/response against a modified one. Small length or timing differences often reveal injection points that are not obvious.

Some apps double-encode parameters. If a single URL-encode doesn't work, try encoding again before sending. Use Decoder to verify.

Intruder payload processing rules let you URL-encode, HTML-encode, or apply custom regex before sending. Use them to handle encoded input fields properly.

In Intruder results, use Grep — Match to flag responses containing errors like "SQL syntax", "exception", "undefined index", which likely indicate vulnerability.

Time-based blind vulnerabilities (SQLi, command injection) cause delays. Sort Intruder results by "Response received" time to spot outliers.

Besides including target hosts, use exclusion rules to exclude logout URLs, static assets, and monitoring endpoints from scans to reduce noise.

Learn shortcuts: Ctrl+R (Repeater), Ctrl+I (Intruder), Ctrl+T (intercept toggle), Ctrl+F (find), Ctrl+Shift+F (find in responses). Saves hours.