0Pricing
Cyber Security Academy · Lesson

Repeater and Intruder

Manipulate requests.

Repeater and Intruder is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Two Manual Testing Tools

Repeater and Intruder are Burp's two core manual-testing tools. Repeater is for careful one-at-a-time tweaking; Intruder is for automated, parameterized attacks.

Together they cover most hands-on web testing.

Repeater Basics

Repeater lets you send the same request over and over, editing it between sends and comparing responses.

It is the workbench where you probe a single endpoint by hand.

Right-click request -> Send to Repeater
Edit -> Send -> read Response
Repeat

Iterating in Repeater

Change one variable at a time so you can attribute any change in the response. Tweak a parameter, send, observe, repeat.

This disciplined loop is how you confirm a vulnerability manually.

POST /api/transfer HTTP/1.1

amount=100&to=acct_55

-> change to=acct_99 and resend
-> compare response codes

Comparing Responses

Repeater keeps a history of your sends. Use response comparison to spot subtle differences between requests.

Differences in length, status, or timing often reveal a vulnerability.

Intruder Overview

Intruder automates sending many variations of a request. You mark payload positions and supply payload lists; Intruder substitutes them and fires the requests.

It is ideal for fuzzing, brute forcing, and enumeration.

Marking Payload Positions

Intruder marks insertion points with section markers. You choose exactly which parts of the request get replaced.

Here the username and password are marked for substitution.

POST /login HTTP/1.1

user=SS-user-SS&pass=SS-pass-SS
(SS marks denote payload positions)

Attack Types

Intruder offers four attack types that control how payloads map to positions.

  • Sniper: one payload set, one position at a time.
  • Battering ram: same payload in all positions.
  • Pitchfork: parallel payload sets.
  • Cluster bomb: every combination.

Choosing Payloads

Payloads can be wordlists, numbers, dates, or generated values. For a login brute force you might load a username list and a password list.

Cluster bomb then tries every username against every password.

Position 1 payload: usernames.txt
Position 2 payload: passwords.txt
Attack type:        Cluster bomb

Reading Intruder Results

The results table shows status code, response length, and timing per request. Sort these columns to find the outlier.

A login that returns a different length or a 302 redirect is often the successful one.

Payload      Status  Length
admin/123    200     842
admin/admin  302     219   <- outlier
admin/pass   200     842

Grep Match and Extract

Configure Intruder to grep responses for a marker string, or to extract a value like a token.

This flags interesting responses automatically and pulls out data across many requests.

Grep - Match: 'Welcome back'
Grep - Extract: csrf_token value

Throttling and Ethics

Intruder can send thousands of requests. Throttle the rate so you do not cause a denial of service, and only attack systems you are authorized to test.

The free Community edition heavily rate-limits Intruder; the Professional edition does not.

Quick Check

Test your understanding of Repeater and Intruder.

Recap

You learned Burp's manual attack tools.

  • Repeater: send and edit one request repeatedly, compare responses.
  • Intruder: automate payloads across marked positions.
  • Attack types: sniper, battering ram, pitchfork, cluster bomb.
  • Sort results by status and length to find outliers.
  • Use grep match/extract; throttle and stay in scope.

Next you will use Scanner and extensions to automate testing.

Frequently asked questions

Is the “Repeater and Intruder” lesson free?

Yes — the full text of “Repeater and Intruder” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Repeater and Intruder”?

Manipulate requests. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Repeater and Intruder” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Proxy and Interception
  2. Repeater and Intruder
  3. Scanner and Extensions
  4. Practical Workflows
← Back to Cyber Security Academy