Burp Suite Cheat Sheet

Configure the default proxy listener address and port

Set up automatic header modification for intercepted requests

Export Burp CA cert for browser installation to intercept HTTPS

Filter proxy history to show only target scope traffic

Add a regex pattern to define the target scope

Test one payload position at a time with a single wordlist

Test all combinations of multiple payload sets across positions

Extract payload values from previous responses (CSRF token extraction)

Define patterns to extract from responses for result analysis

Limit request rate to avoid triggering WAF or rate limits

Send a request to Repeater for manual modification and replay

Send multiple tabs simultaneously for race condition testing

Chain encoding operations for payload transformation

Visually diff two responses to identify behavioral differences

Start a full crawl and active vulnerability scan

Use embedded browser for JavaScript-heavy application crawling

Scan a specific portion of the site map only

Generate a formatted HTML vulnerability report

Install Autorize for automated authorization testing

Install Logger++ for advanced request/response logging

Install Param Miner for hidden parameter and header discovery

Install Active Scan++ for additional active scan checks

Configure path for custom extension JAR dependencies