12:22 PM
@JohnZhau Burp has a lot of uses. For one, being able to modify a request on the fly without the browser interfering is very valuable. Another very useful tool that Burp offers is the Repeater, where you can quickly replay a request and manually edit everything (endpoint, cookie, parameters, headers, etc.)
The Intruder is another useful tool, which allows you to quickly throw a set of data against a HTTP endpoint. You can use it to check if there was brute-force protection, account lockouts, etc...
Sure, all these things can be automated, but imagine you only have 5 days to pentest a web application, do you want to waste time writing a python script from scratch that sends a wordlist to an endpoint at a specific position in a HTTP request, or do you want to be able to press CTRL+I
, select the insertion point, select the list and click "Go"?
It's the unfortunate reality of penetration testing that in a lot of projects, you have way too little time to test everything extensively. And as such, every little tool that helps you save time is much appreciated.
Another good example is the Burp Decoder. Sure, Burp isn't the only tool that allows you to encode a string to an URI string or decode some Base64 data. But it has the advantage that it's right inside the tool you're already using. It means I only need to press a shortcut to convert something from one format to another, instead of having to go to a different program.
Usually, you only whip out custom scripts when you really have something to gain from it.