X-BUR
Burp Intruder
Burp Suite's built-in customizable attack tool for automating fuzzing, brute-force, and parameter-manipulation attacks.
OVERVIEW
Burp Intruder takes any base request captured by Burp Suite's proxy (see the separate Burp Suite entry on this site) and repeats it with one or more positions swapped for values from a payload set — a wordlist, a number range, a Base64/hash-encoded transform, or a custom payload processor chain. Four attack types (Sniper, Battering ram, Pitchfork, Cluster bomb) cover single-parameter fuzzing up to multi-parameter combinatorial attacks.
Community Edition includes Intruder but throttles it to roughly one request per second, which is workable for a short, targeted attack; Professional removes that throttle and adds a resource pool to run several attacks in parallel, which matters once the target or the payload set gets large.
USE CASES
Practical use cases
- 01
Brute-forcing a login field or token with a wordlist using the Sniper attack type.
- 02
Enumerating sequential or predictable IDs (IDOR candidates) by sweeping a numeric range through a URL or parameter.
- 03
Fuzzing a parameter with a payload set of injection strings to spot anomalous responses worth manual follow-up.
- 04
Running a Pitchfork or Cluster bomb attack to test combinations of two related parameters, such as a username/password pair.
QUICK START
Once a request from Repeater is worth automating — brute-forcing a field, fuzzing a parameter, or enumerating IDs — to run it as a controlled attack.
- Confirm the target and rate of automated requests are within the agreed scope — Intruder can generate thousands of requests quickly.
- Send a captured request from the proxy or Repeater to Intruder.
- Mark the position(s) to attack and choose the attack type (Sniper, Battering ram, Pitchfork, or Cluster bomb).
- Load the payload set (wordlist, number range, or custom list) for each marked position.
- Start the attack, then sort results by status code, length, or response time to spot anomalies worth manual review.
BEFORE YOU RUN IT
What to check before running it
Community's ~1 req/sec throttle makes large payload sets impractical — budget engagement time accordingly or plan for Professional.
An unthrottled attack against a fragile or rate-limited service can trigger account lockouts or a denial of service — tune the request rate to what was agreed with the client.
Sort and filter results before reading them one by one; a Cluster bomb attack against two sizeable payload sets can produce results in the tens of thousands.