Burp Suite — Key Modules
|
Module |
Purpose |
|
Proxy |
Intercept all browser traffic — modify requests and responses in real time |
|
Repeater |
Manually craft and resend HTTP requests to test different inputs |
|
Intruder |
Automated attack tool for brute force, fuzzing, and parameter tampering |
|
Scanner |
Automated vulnerability detection (Pro version — free alternatives exist) |
|
Decoder |
Encode/decode URL, Base64, HTML entities, hex data |
|
Comparer |
Compare two responses to spot differences (useful in blind attacks) |
|
Sequencer |
Analyze randomness of session tokens to detect predictable patterns |
Â
API Security Testing
- OWASP API Security Top 10 — Broken Object Level Auth, Excessive Data Exposure, etc.
- Use Postman to manually test APIs — check for IDOR vulnerabilities
- Look for API keys exposed in JavaScript source code (browser DevTools)
- Test JWT tokens — decode on jwt.io, check for algorithm: none vulnerability
Â
|
Placement Tip: Know how to explain IDOR (Insecure Direct Object Reference) with a real-world example: ‘If changing /profile?id=123 to /profile?id=124 shows another user’s data — that’s IDOR.’ |