[joepvand]

Ive just started to mess around with burp-suite, i see it is really advanced but i don't see that much use for it. It can do a lot but all i really been using it for is to modify request headers.

[Becky G]

You can use intruder for botting logins or requests, there are a lot more options but that's what I use it for.

[joepvand]

You can use intruder for botting logins or requests, there are a lot more options but that's what I use it for.

Botting the login, as in a sentrymba like form? with combolists and such?
And the request botting part i dont get? could you explain me more about it?

[Becky G]

Its pretty much the equivalent to sentry except with sentry you can make a secondary request based on the returned data. You would simply enable your proxy on burp, intercept data, click "send to intruder" and from there you can set which variables you would like and customize different types of combo lists and then on the "Options" page if you go to "Grep-Extract" you can make burp read source code and show specific details from the results, such as a boolean result telling if the password was correct or not.

[Dark TruTH]

check their website you will see all the features...

[Kyle1995]

I use it to proxy web traffic and reverse engineer mobile apps but it can be used for a lot more, burpe is the shit.

[Evanescent]

I use it to brute force, fuzzing, scan, there is no limit with that wonderful tool.

[PinkHamburgers]

I've been using it to poke around at musical.ly's internals to find vulnerabilities.

[Kyle1995]

I've been using it to poke around at musical.ly's internals to find vulnerabilities.

How so?

[joepvand]

I've been using it to poke around at musical.ly's internals to find vulnerabilities.

really? how so?

[dotcomsuper]

there is youtube tuto for it it's for professionals

[joepvand]

there is youtube tuto for it it's for professionals

lol wut

[joepvand]

what else do you guys use this for?

[Gee4rce]

For those who are looking to a free equivalent to Burp, check out "Fiddler": http://telerik.com/fiddler
It's basically the same than Burp, Powerfull, and for free... just to name a propper alternative.
Cheers, Gee.

[๖ۣۜCriminal]

I prefer fiddler and live http headers extension over burp suite I usually use that to find every http endpoint on the site and gather them into a text file, then I slowly test each parameter for vulns.