2.1) Tab : Proxy (Options)

Intercepts only URLs in scope

(request / response)

6

2.1) Tab : Proxy (Options)

Stop intercepting Websockets

7

2.1) Tab : Proxy (Options)

Edit, add or remove : headers, body or params

(requests / responses)

8

2.2) Tab : Target (ctrl+shift+t)

Add / remove URLs from scope

10

2.2) Tab : Target (ctrl+shift+t)

Show only scope items

11

2.2) Tab : Target (ctrl+shift+t)

Search string in website

12

Pro version

2) Tab : Intruder (ctrl+shift+i)

Demo :

• Iterates through lists
• Match text in responses
• Payload processing (suffix and prefix)
• Payload encoding (URL encoding)

14

2) Tab : Intruder (ctrl+shift+i)

Attack types

1. Sniper : Replaces only one position at a time. After its done with the first position, it continues with the second position.

2. Battering ram : Same payload value in all positions. It loops through the payload set and replaces all positions with the payload value.

3. Pitch fork : Uses one payload set for each position. It places the first payload in the first position, the second payload in the second position, and so on.

4. Cluster bomb : The cluster bomb attack tries all different combinations of payloads. (example : bruteforce with a list of users and passwords.).

15

2.4) Tab : Repeater (ctrl+shift+r)

Rename your tabs (same for Intruder)

17

2) Tab : Repeater (ctrl+shift+r)

Auto scroll on change

18

2) Tab : Repeater (ctrl+shift+r)

Generate CSRF PoC

19

Pro version

2) Tab : Repeater (ctrl+shift+r)

20

Javascript auto-submit

Pro version

2) Tab : User (options)

Turn on dark mode

22

2) Tab : User (options)

Disable interception on startup

23