Results for “intruder”

Master Burp Suite Professional for comprehensive web application security testing. Use this skill when performing manual web application assessments with Burp Suite including proxy interception, Scanner automation, Intruder attacks, Repeater analysis, and extension integration. Covers advanced techniques like match-and-replace rules, macro authentication, Collaborator for OOB testing, and Turbo Intruder for high-speed fuzzing.

The English summary is being prepared. Showing the original description.

Test web application security with Burp Suite by capturing, modifying, and replaying browser requests. Learn to define testing scope, compare responses, investigate weaknesses manually, and review automated scan findings in Professional Edition.

• Setting up a proxy to inspect web traffic
• Replaying modified requests with Repeater
• Checking access controls and pricing logic

Assessment of pseudonymization techniques and re-identification risk. Covers tokenization, hashing, encryption-based pseudonymization, and hybrid approaches. Includes re-identification risk scoring using the motivated intruder test, quantitative metrics (marketer, journalist, prosecutor models), and linkage attack resilience evaluation. References ENISA 2019 pseudonymization report.

The English summary is being prepared. Showing the original description.

Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.

The English summary is being prepared. Showing the original description.

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.

• Assessing damage possible after a workstation compromise
• Reviewing Active Directory paths to higher privileges
• Testing internal network security controls

Prepare screenshots and network traffic records for bug bounty submissions by masking session secrets and personal data while preserving useful verification details. The skill covers capture setup, HAR cleanup, evidence filenames, and credential handling after submission.

• Masking secrets in evidence screenshots
• Cleaning HAR files before submission
• Capturing evidence in Burp Suite and Chrome DevTools

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.

• Review checkout prices and currency handling
• Check coupons and credits for repeated redemption
• Inspect email and phone verification flows

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

The English summary is being prepared. Showing the original description.

Drive Burp Suite over its MCP server as an AI triage + attack layer - review proxy history for signals, replay via Repeater/send, OOB-gate blind bugs with Collaborator, fuzz via Intruder (RoE-safe), then hand off to the matching vuln-class hunt. Wiki-first, FIND schema output.

The English summary is being prepared. Showing the original description.

Classifies data as pseudonymised or anonymised using Recital 26 reasonably likely test, Breyer ruling C-582/14, motivated intruder test, and WP29 Opinion 05/2014 on anonymisation techniques. Covers singling out, linkability, and inference tests. Keywords: pseudonymisation, anonymisation, Recital 26, re-identification, k-anonymity, differential privacy, WP29 Opinion 05/2014.

The English summary is being prepared. Showing the original description.

Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.

The English summary is being prepared. Showing the original description.

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

The English summary is being prepared. Showing the original description.

Identify and exploit default or weak credentials on web application login forms, admin panels, CMS backends (WordPress wp-admin, Joomla, Drupal), and embedded device management interfaces. Signals include framework fingerprinting (WhatWeb, Wappalyzer, Nikto), exposed admin paths from robots.txt/dirbusting, and weak password policy acceptance of "Password1" or "123456". Tools: Burp Suite Intruder, Hydra, Medusa, OWASP ZAP.

The English summary is being prepared. Showing the original description.

Web race condition exploitation — TOCTOU, single-packet attack, limit overrun, parallel race testing

The English summary is being prepared. Showing the original description.

Develop Burp Suite extensions in Java (Montoya API) or Python (Jython). Supports creating HTTP listeners, scanner checks, intruder payloads, UI tabs, and context menus. Includes project templates, multi-platform setup guides, and best practices.

The English summary is being prepared. Showing the original description.

Race condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.

The English summary is being prepared. Showing the original description.