ProfessionalCommunity Edition

Obtaining a token sample

• Last updated: March 1, 2024

• Read time: 2 Minutes

You need to obtain a sample of tokens to run a Burp Sequencer analysis. You can do this in two ways:

• Perform an automatic live capture of tokens directly from the target.
• Manually load a sample of tokens that you have already acquired.

Configuring a live capture of tokens

To automatically capture tokens from the target response:

1. Locate a request that returns a token that you want to analyze.
2. Right-click the request and choose Send to Sequencer from the context menu. You can send a request from anywhere in Burp.
3. Select the token in the Token location within response panel.
4. Click Start live capture.

A new results window opens, in which Sequencer repeatedly issues the request and extracts the relevant token from the application's responses. To learn about the live capture process, see Burp Sequencer live capture.

Selecting a token location

You can specify the token you want to analyze in the Token location within response panel. The following options are available:

• Cookie - Select a cookie from the drop-down list. This is the most common method to pass session tokens to clients.
• Form field - Select an HTML form field value from the drop-down list. You can use this method to transmit anti-CSRF tokens and other per-page tokens to clients.
• Custom location - Specify a custom location within the response that contains the token you want to analyze. This uses the response extraction rule dialog. This is useful when the token doesn't appear in a usual form field.

Manually loading tokens

You can load Sequencer with a sample of tokens that you have already obtained, for example from an earlier live capture, or an Intruder attack:

1. Go to Sequencer > Manual load.

2. Insert the tokens:

   • To paste tokens from the clipboard, click Paste.
   • To load tokens from a file, click Load.
3. Use the details of the shortest and longest lengths in the display field to make sure that the sample has loaded correctly.
4. Click Analyze now. The analysis begins in a new results window.