Manipulate and Re-send Requests in Burp Repeater

Introduction

Welcome to this lab on using Burp Repeater. Burp Repeater is a simple but powerful tool within Burp Suite for manually manipulating and reissuing individual HTTP requests, and analyzing the application's responses. It is a fundamental tool for any web application security tester, allowing you to probe for vulnerabilities by observing how a server responds to different inputs.

In this lab, you will learn the core workflow of Burp Repeater. You will start by capturing a standard request from a web application, sending it to Repeater, modifying its parameters, and then re-sending it to the server. Finally, you will analyze the server's response to your modified request and learn how to navigate the request history.

Select a Request in a Repeater Tab

In this step, you will capture a request from a sample web application and send it to Burp Repeater for manipulation. The lab environment has already started a web application and Burp Suite for you. The browser is configured to proxy traffic through Burp Suite.

First, let's generate some traffic.

1. Open the web browser from the desktop.
2. Navigate to the target application by entering http://127.0.0.1:5000 in the address bar.
3. You will see a simple login form. Leave the default values (user and pass) and click the Submit button.

Now, let's find this request in Burp Suite.

1. Switch to the Burp Suite window.
2. Go to the Proxy tab, and then click the HTTP history sub-tab. You will see a list of requests your browser has made.
3. Look for a POST request to the /login endpoint. It should be near the top of the list. Click on it to view its details in the panels below.
4. Right-click anywhere in the request panel and select Send to Repeater from the context menu. You can also use the hotkey Ctrl+R.

A new tab will appear and flash orange in the Repeater tool. Click on the Repeater tab to view the request you just sent.

Modify a Header or Parameter Value

In this step, you will modify the request that you sent to the Repeater tab. The Repeater UI is split into two main sections: the request panel on the left and the response panel on the right. Currently, the response panel is empty because we haven't sent the request from Repeater yet.

Let's focus on the request panel on the left. You can edit any part of the request here before sending it. This includes the request line, headers, and the request body.

1. Look at the bottom of the request panel. You will see the body of the POST request, which contains the form data: username=user&password=pass.
2. Let's test if we can log in as a different user. Change the value of the username parameter from user to admin. The line should now look like this: username=admin&password=pass.
3. You can also modify headers. For example, find the User-Agent header and change its value to something custom, like My-Custom-Browser/1.0.

Your modified request in the left panel is now ready to be sent.

Click the 'Send' Button to Issue the Modified Request

In this step, you will send the modified HTTP request to the server. After editing the request in the left panel, the next action is to transmit it.

At the top of the request panel, you will find a Send button. This button is used to issue the current request displayed in the panel.

1. Ensure your request has been modified as described in the previous step (e.g., username is set to admin).
2. Click the Send button.

Burp Repeater will now send this modified request to the target server at 127.0.0.1:5000. After a moment, the server's response will appear in the response panel on the right.

Analyze the Response from the Server

In this step, you will analyze the server's response to your modified request. After you clicked Send, the response panel on the right was populated with the data returned by the server.

1. Examine the response panel. You will see the full HTTP response, including the status line (e.g., HTTP/1.0 200 OK), response headers, and the response body.
2. Look at the response body. Since our test application reflects the username in its output, you should see the message: Login attempt for user: 'admin' failed. Please try again.. This confirms that the server processed our modified input.
3. Above the response body, there are several view options: Pretty, Raw, Hex, and Render.
   • Pretty: Shows a formatted version of the response, which is helpful for HTML and JSON.
   • Raw: Shows the exact bytes received from the server.
   • Render: Attempts to render the response as a web browser would. Click on Render to see a visual representation of the login page with the failure message.

Analyzing responses is a critical skill. By sending different payloads and observing the responses, you can discover how an application behaves and identify potential vulnerabilities.

Use the History Arrows to Navigate Between Sent Requests

In this step, you will learn how to use the history navigation feature within a Repeater tab. Repeater keeps a history of all the requests you have sent in the current tab, which is very useful for comparing the responses to slightly different requests.

Next to the Send button, you will see a number (currently 1) and back/forward arrows (< and >). These allow you to step through the request history.

1. Let's create another history entry. In the request panel, change the username back to user.
2. Click Send again. You will see the response update to reflect the login attempt for user. The number next to the Send button now shows 2.
3. Now, click the back arrow (<). The request and response panels will update to show your first request (with username=admin) and its corresponding response. The number will change back to 1.
4. Click the forward arrow (>) to return to the second request (with username=user).

This feature allows you to quickly test variations of a request and compare the results without needing to manually re-type your changes or manage multiple Repeater tabs.

Summary

In this lab, you have learned the fundamental operations of Burp Repeater, a core component of Burp Suite.

You successfully captured an HTTP request from a web application and sent it to Repeater. You then practiced modifying the request's parameters and headers, re-issuing the modified request to the server, and analyzing the resulting response. Finally, you learned how to use the history navigation to efficiently switch between different requests you've sent.

Mastering Burp Repeater is a key step in becoming proficient at manual web application security testing, as it provides the control needed to probe for a wide range of vulnerabilities.