3 ms·

Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.

by daeken 14y ago

tptacek 14y ago
Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.
- recuter 14y ago
  So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.
  - tptacek 14y ago
    You could use it to benchmark (it might be useful for that in cases where what you were benchmarking wasn't raw request handling speed, or the performance of simple SQL queries, but rather some backend event that would only be tickled by a particular pattern of requests), but the real thing it does that I think ab doesn't do is collect all the responses and allow you to compare them. (It's actually not great at doing those comparisons, but I don't have a better alternative). Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.
    - daeken 14y ago
      > Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate. Couldn't agree enough. Even if this is something you do as a hobby, Burp will more than pay for itself in a single bug bounty payout.
  - recuter 14y ago
    I meant expensive for somebody who is new to the topic and just wants to play with it. Its an inertia thing.
    - wglb 14y ago
      Check out the free version. It still has significant capabilities, including intruder.
- anigbrowl 14y ago
  $299/year seems pretty affordable, I was expecting to see something that cost thousands from the way you were talking. I know zilch about Appsec, but this appeals to the part of me that's good at breaking things.

Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.

by daeken 14y ago

Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.

tptacek 14y ago

Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.

recuter 14y ago
So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.
- tptacek 14y ago
  You could use it to benchmark (it might be useful for that in cases where what you were benchmarking wasn't raw request handling speed, or the performance of simple SQL queries, but rather some backend event that would only be tickled by a particular pattern of requests), but the real thing it does that I think ab doesn't do is collect all the responses and allow you to compare them. (It's actually not great at doing those comparisons, but I don't have a better alternative). Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.
  - daeken 14y ago
    > Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate. Couldn't agree enough. Even if this is something you do as a hobby, Burp will more than pay for itself in a single bug bounty payout.
- recuter 14y ago
  I meant expensive for somebody who is new to the topic and just wants to play with it. Its an inertia thing.
  - wglb 14y ago
    Check out the free version. It still has significant capabilities, including intruder.
anigbrowl 14y ago
$299/year seems pretty affordable, I was expecting to see something that cost thousands from the way you were talking. I know zilch about Appsec, but this appeals to the part of me that's good at breaking things.