Burp Suite & API Security Testing - CollegePassouts

Introduction to Ethical Hacking for Students Burp Suite & API Security Testing

Burp Suite — Key Modules

Module	Purpose
Proxy	Intercept all browser traffic — modify requests and responses in real time
Repeater	Manually craft and resend HTTP requests to test different inputs
Intruder	Automated attack tool for brute force, fuzzing, and parameter tampering
Scanner	Automated vulnerability detection (Pro version — free alternatives exist)
Decoder	Encode/decode URL, Base64, HTML entities, hex data
Comparer	Compare two responses to spot differences (useful in blind attacks)
Sequencer	Analyze randomness of session tokens to detect predictable patterns

API Security Testing

OWASP API Security Top 10 — Broken Object Level Auth, Excessive Data Exposure, etc.
Use Postman to manually test APIs — check for IDOR vulnerabilities
Look for API keys exposed in JavaScript source code (browser DevTools)
Test JWT tokens — decode on jwt.io, check for algorithm: none vulnerability

Placement Tip: Know how to explain IDOR (Insecure Direct Object Reference) with a real-world example: ‘If changing /profile?id=123 to /profile?id=124 shows another user’s data — that’s IDOR.’