Repeater
Repeater is Burp's manual testing workbench. You send individual requests from Proxy history (or any other tool) to Repeater, then manually edit and resend them to test for vulnerabilities. It is the primary tool for hands-on parameter tampering, header manipulation, and response analysis.
Repeater supports HTTP/1, HTTP/2, and WebSocket. You can modify every aspect of a request: URL, method, headers, cookies, body. Responses are color-coded (2xx green, 4xx/5xx red) and contain raw, hex, and pretty-printed views.
Sending Requests to Repeater
The fastest way to get requests into Repeater:
From Proxy HTTP history or Site map, right-click any request → Send to Repeater
Select a request in history, press Ctrl+R to send immediately
Drag a request from Proxy history to the Repeater tab
Select request → top menu: "Action" → "Send to Repeater"
Tip
Repeater Interface
Each Repeater tab contains two panels: request (left/right or top/bottom depending on layout). Edit the request and click "Send" to see the response.
Request Editor
- Raw edit mode (default)
- Hex editor for binary data
- Automatic URL/params decoding
- Syntax highlighting
- Header and body split view
Response Viewer
- Raw, hex, and pretty-print views
- HTML rendering with syntax highlighting
- Search within response
- Copy as curl command
- Send to Comparer, Decoder, or Intruder
Repeater Actions
Send Request
Send the current request and display the response. Shortcut: Ctrl+Enter or click the "Send" button.
Follow Redirects
Automatically follow HTTP 3xx redirects to the final destination instead of showing intermediate responses.
Clear
Clear both request and response panels to start fresh.
Save
Save the current request to a file for later use.
Paste from Browser
Quickly paste raw HTTP request copied from browser DevTools.
URL-encode / Decode
Automatically encode/decode parameter values and path segments using Burp's smart encoding.
Duplicate Tab
Clone the current request into a new tab for parallel testing of variations.
Repeater Keyboard Shortcuts
Common Testing Workflow
Here's how to use Repeater for common vulnerability tests:
SQL Injection
Intercept request → send to Repeater → modify parameter to test for SQL errors or boolean-based injection → observe response differences.
XSS
Send request to Repeater → inject <script>alert(1)</script> into input fields → check if script executes in response HTML.
Access Control Bypass
Modify session cookie or user ID parameter → resend as another user → check if you can access unauthorized data.
Header Manipulation
Add/modify headers like X-Forwarded-For, Host, or Authorization to test for host header injection, authentication bypass, or SSRF.
Warning