Methodology

Testing Workflow

A structured methodology ensures thorough testing and maximizes vulnerability discovery. Follow this workflow for consistent results on any web application.

Systematic Workflow

Eight-step process from setup to report:

1

Configure Proxy & Scope

Set browser proxy to 127.0.0.1:8080. Install CA cert. Define target scope in Burp to prevent capturing unrelated traffic.

KEY: FoxyProxy or manual proxy settings
2

Browse Target Normally

Visit the application like a regular user. Burp's Proxy captures all HTTP/S traffic and logs it to HTTP history. Spider if needed to discover hidden endpoints.

KEY: Spider: Target → Spider control → start
3

Reconnaissance

Review HTTP history and Site map. Identify interesting endpoints: login pages, admin panels, API endpoints, file upload forms, parameters with IDs.

KEY: Look for .php, .asp, /admin, /api, ?id=
4

Manual Testing (Repeater)

Send interesting requests to Repeater (Ctrl+R). Modify parameters, headers, cookies to test for SQLi, XSS, auth bypass, IDOR, path traversal. Analyze responses carefully.

KEY: Repeater: Ctrl+R, Ctrl+Enter to send
5

Automated Fuzzing (Intruder)

For parameters that look injectable, use Intruder with Sniper or Cluster Bomb attack. Load wordlists, set payload positions, and analyze results.

KEY: Intruder: Ctrl+I, mark positions with §, select attack type
6

Automated Scanning

Run active scan on discovered endpoints (Pro required). Review generated issues, validate true positives, and eliminate false positives.

KEY: Right-click → Scan selected requests
7

Advanced Attacking

Use extensions (Turbo Intruder, Autorize, JWT Editor) for specialized attacks. Test for OAST (out-of-band) with Collaborator.

KEY: Collaborator payloads: burpcollaborator.net
8

Reporting

Compile findings: vulnerability name, affected URL, proof-of-concept, impact, remediation. Export Scanner issues as HTML or generate report from issues.

KEY: Scanner → Issues → Report → Export

Reconnaissance Phase

Before testing, understand what you are attacking:

Spider the site to map all accessible pages (Target → Spider)
Review Site map for hidden endpoints (/robots.txt, /.git/, backup files)
Check content types: JSON/XML APIs often have different vulnerabilities than HTML
Look for session tokens, cookies, CSRF tokens in requests
Identify input parameters: query, form fields, headers, path segments

Info

Burp's Spider auto-crawls links and forms. However, spidering can miss hidden endpoints — combine with manual browsing and passive scanning for best coverage.

Manual Testing Examples

Here are common vulnerabilities and how to test for them in Repeater:

1

SQL Injection

Send parameter to Repeater → try ' OR 1=1 -- → check for error or different response length

2

XSS

Inject <script>alert(1)</script> → check if script executes in browser or appears reflected

3

IDOR

Change user ID in URL/parameter from /account/123 to /account/456 → check if data leaks

4

Path Traversal

Replace parameter with ../../../etc/passwd → check if file contents appear in response

5

Command Injection

Try | id or ; whoami in parameter → look for command output in response

6

SSRF

Inject http://burpcollaborator.net → check Collaborator for DNS/HTTP callbacks

7

XXE

Inject <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>...

8

insecure Deserialization

Modify serialized objects (PHP, Java, .NET) — hard without debugging; look for gadget chains

Scope Management

Always define a target scope before attacking. Scope prevents accidental testing of unauthorized systems, speeds up scans, and keeps your project manageable.

Setting Scope (Target tab)
1. Add target URL(s): https://target.example.com/*
2. Include specific paths if needed: /admin, /api/*
3. Exclude static resources to reduce noise: *.png, *.jpg, *.css
4. Enable "Use advanced scope control" for fine-grained filtering

Warning

Out-of-scope hosts are grayed out in Site map. Some tools (Scanner, Intruder) respect scope and will not attack excluded hosts.

Validation & False Positives

Automated tools generate false positives. Always manually verify before reporting:

SQLi: Try UNION-based payload to confirm database content retrieval.
XSS: Use script tag → check if alert box appears in actual browser (not just reflected).
SSRF: Trigger Collaborator domain → verify DNS/HTTP callback received.
Auth bypass: Test with two different user accounts to confirm privilege escalation.
LFI: Verify file content actually appears in response, not just 200 OK.
Next: Command Builder Back