Repeater and Intruder
Modify and fuzz.
Repeater and Intruder is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Repeater and Intruder Overview
Once you capture a request, two tools let you experiment with it. Repeater is for careful manual testing — send one request, tweak it, send again. Intruder automates sending many variations to fuzz parameters.
Sending to Repeater
From HTTP history or the proxy, right-click a request and choose Send to Repeater (Ctrl+R). It opens in a tab where you can edit the raw request on the left and view the response on the right.
Right-click request -> Send to Repeater (Ctrl+R)Iterating in Repeater
Repeater is ideal for probing one parameter at a time. Change a value, hit Send, and compare responses. Burp shows status code, length, and response time so you can spot meaningful differences.
GET /product?id=1 HTTP/1.1
Host: target.local
# change id to 1 OR 1=1 and resendSpotting Behavioral Differences
Subtle response changes reveal vulnerabilities. A different length, a new error message, or a changed status code after injecting a payload often signals SQL injection, IDOR, or broken access control.
Sending to Intruder
For automation, right-click and choose Send to Intruder (Ctrl+I). Intruder repeats a request many times, substituting payloads into positions you mark with § markers.
Right-click request -> Send to Intruder (Ctrl+I)Marking Payload Positions
In the Positions tab, Burp auto-marks parameters. Clear them and place your own §§ markers exactly where payloads should go.
POST /login HTTP/1.1
username=admin&password=§pass§Attack Type: Sniper
Sniper uses one payload set and targets each marked position in turn, one at a time. Best for fuzzing a single field, e.g. brute forcing a password for a known username.
Attack Type: Cluster Bomb
Cluster bomb uses multiple payload sets and tries every combination — ideal for spraying username/password pairs. Pitchfork instead pairs sets by index, and Battering ram puts the same payload in all positions.
Payload Sets and Processing
The Payloads tab loads wordlists or generates payloads (numbers, brute force, dates). Payload processing rules can hash, prefix, URL-encode, or base64 each payload before sending.
Payload type: Simple list
Processing rule: Add prefix "admin_"
Processing rule: Hash MD5Analyzing Intruder Results
Sort results by status, length, or response time to find the outlier. A login that succeeds usually returns a different length or a 302 redirect compared to failed attempts. Use Grep - Match to flag responses containing "Welcome" or "Invalid".
Throttling and Rate Limits
The Community edition throttles Intruder heavily. In real engagements, set resource-pool throttling to avoid overwhelming the target and to evade lockouts. Aggressive fuzzing can cause denial of service — always stay within authorized scope and agreed limits.
Quick Check
Choose the right Intruder attack type.
Recap
You explored Burp's manual and automated request tools:
- Repeater — iterate on a single request and compare responses
- Intruder — fuzz marked
§§positions with payload sets - Attack types: Sniper, Battering ram, Pitchfork, Cluster bomb
- Sort by status/length and use Grep-Match to find hits
Next: Burp's automated Scanner.
Frequently asked questions
Is the “Repeater and Intruder” lesson free?
Yes — the full text of “Repeater and Intruder” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Repeater and Intruder”?
Modify and fuzz. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Repeater and Intruder” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Proxy and Interception
- Repeater and Intruder
- Scanner
- Extensions