𝗙𝗢𝗥 𝗪𝗘𝗕 𝗣𝗘𝗡𝗘𝗧𝗥𝗔𝗧𝗜𝗢𝗡 𝗧𝗘𝗦𝗧𝗜𝗡𝗚

━━━━━━━━━━━━━━━━━━

𝗔𝗨𝗧𝗛𝗢𝗥𝗜𝗭𝗔𝗧𝗜𝗢𝗡 & 𝗔𝗖𝗖𝗘𝗦𝗦 𝗖𝗢𝗡𝗧𝗥𝗢𝗟

• BurpLay → replay requests to detect privilege escalation

• AuthMatrix → test access across roles

• Autorize → auto-detect authorization flaws

• Auth Analyzer → test with custom tokens

• Burp SessionAuth → session-based privilege issues

• Authz → quick authorization testing

━━━━━━━━━━━━━━━━━━

𝗥𝗘𝗤𝗨𝗘𝗦𝗧 𝗔𝗨𝗧𝗢𝗠𝗔𝗧𝗜𝗢𝗡

• AutoRepeater → automate request replay + diff

• IncrementMe Please → auto-increment parameters

━━━━━━━━━━━━━━━━━━

𝗥𝗘𝗖𝗢𝗡 & 𝗗𝗜𝗦𝗖𝗢𝗩𝗘𝗥𝗬

• LinkFinder → extract endpoints from JS

• JS Miner / JS Parser → find sensitive data in JS

━━━━━━━━━━━━━━━━━━

𝗧𝗢𝗞𝗘𝗡 & 𝗔𝗨𝗧𝗛 𝗧𝗘𝗦𝗧𝗜𝗡𝗚

• JWT Editor → test JWT vulnerabilities

• Turbo Intruder → high-speed attacks (race, brute)

━━━━━━━━━━━━━━━━━━

𝗙𝗨𝗭𝗭𝗜𝗡𝗚 & 𝗦𝗖𝗔𝗡𝗡𝗜𝗡𝗚

• ActiveScan++ → improved scanning coverage

• Backslash Powered Scanner → injection detection

━━━━━━━━━━━━━━━━━━

𝗔𝗗𝗩𝗔𝗡𝗖𝗘𝗗 𝗔𝗧𝗧𝗔𝗖𝗞𝗦

• HTTP Request Smuggler → find smuggling bugs

• Content Type Converter → bypass filters

━━━━━━━━━━━━━━━━━━

𝗣𝗥𝗢𝗗𝗨𝗖𝗧𝗜𝗩𝗜𝗧𝗬

• Logger++ → advanced request logging

• Flow → visualize request flow

━━━━━━━━━━━━━━━━━━

𝗥𝗘𝗔𝗟𝗜𝗧𝗬

Installing tools ≠ finding bugs

Understanding logic = finding bugs

━━━━━━━━━━━━━━━━━━

𝗨𝗦𝗘 𝗧𝗛𝗜𝗦 𝗟𝗜𝗞𝗘 𝗔 𝗣𝗥𝗢

Start with recon → test auth → fuzz → automate → verify