ProfessionalCommunity Edition

Identifying which parts of a token impact the response with Burp Suite

• Last updated: October 29, 2024

• Read time: 2 Minutes

Sometimes an application may only inspect certain parts of a token. You can use the Character frobber and Bit flipper payload types in Burp Intruder to modify the value of each character or bit position of a token in turn. This enables you to identify which parts of the token impact the response you receive.

For example, if you modify the value of a character in a session token and your request is still processed in your session, it is likely the character is not used to track your session.

Steps

To identify which parts of a token impact the response:

1. Identify a message that includes a token that you want to investigate further, such as a session token.
2. Highlight the token, then right-click the message and click Send to Intruder.

3. Go to Intruder. Notice that the token is automatically marked as a payload position.

4. In the Payloads side panel, change the Payload type to Character frobber.

5. Add an extract grep for sections of interest in the response, such as a verbose error message:

   1. Under Grep - Extract, click Add. The Define extract grep item dialog opens.
   2. Highlight the section in the response that you want to extract, such as an error message.
   3. Click OK. The item is added to the list. When you start the attack, Intruder extracts the text at this location in each response and displays it in the results table.
6. Click Start attack. Burp Intruder modifies the encrypted value of each character in the token in turn.
7. When the attack is finished, study the responses to look for any behavior that may indicate the modification has impacted the token validity or changed the response. For example, look for any anomalous error messages or status codes.