Actions on the intercepted requests

Once we have an intercepted request, we can send it to Repeater (Ctrl + R) to manipulate it one by one; we can send it to Intruder (Ctrl + I) to simulate an automated attack; we can send it for more spidering, an active scan or even to a Sequencer, Decoder, or Comparer (covered in the next chapter):

Actions on the intercepted requests

The question to ask is what should decide whether we should use Repeater or Intruder?. The short answer is, it is up to you. I personally use Repeater to figure out whether there is a flaw worth using Intruder or not. An active scan is always the last resort for the sake of completeness. This might change based on time ...

Get Burp Suite Essentials now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.