login

Burp Suite, the leading toolkit for web application security testing

Payload Processing

The payloads generated by the configured payload type can be further manipulated using various payload processing rules and payload encoding.

Payload Processing Rules

You can define rules to perform various processing tasks on each payload before it is used. The defined rules are executed in sequence, and can be toggled on and off to help debug any problems with the configuration. Payload processing rules are useful in many kinds of situation where you need to generate unusual payloads, or need to wrap payloads up within a wider structure or encoding scheme prior to use.

The following types of rule are available:

Payload Encoding

You can configure which characters within the payload should be URL-encoded for safe transmission within HTTP requests. Any configured URL-encoding is applied last, after any payload processing rules have executed.

It is recommended to use this setting for final URL-encoding, rather than a payload processing rule, because the payload grep option can be used to check responses for echoed payloads before the final URL-encoding is applied.

Support Center

Get help and join the community discussions at the Burp Suite Support Center.

Visit the Support Center ›

Monday, January 16, 2017

1.7.16

This release adds various enhancements and fixes:

  • There is a new command-line option to launch Burp with a specified user configuration file.
  • A bug that was recently introduced that prevented license activation in headless mode has been fixed.
  • The Content Discovery function now correctly handles applications that have wildcard behavior for file extensions (e.g. those that return a specific response for admin.xxx regardless of the file extension). This eliminates the only known false positives reported by the new Content Discovery engine.

See all release notes ›

Copyright © 2016 PortSwigger Ltd. All rights reserved.