You should have noticed the pun in this post title 😉. That's right, some powerful Burp Suite extensions can make the free community edition as good as the Burp Pro version. Knowing how to use those extensions will make you feel like a pro.
Turbo Intruder
Let's start with Turbo Intruder. It's one of the most (if not the most) popular Burp extensions. Basically, anyone who knew Burp extensions should have heard the name of Turbo Intruder.
The Burp Suite community edition comes with a "lite" version of Burp Intruder. The first impression of this community edition Intruder is: It has really low RPS (Request Per Second). The time you waited for finishing a 1000-request brute-forcing attack can make you grow out some gray hair, slow and anxious. Meanwhile, the Burp Pro version provides a decent speed Burp Intruder, which is suitable for daily usage.
However, Turbo Intruder is a beast on another level. It's fast and furious. To be honest, I never hit once its full speed and I don't know how fast it can truly go...
Another highlight of the Turbo Intruder is the customization. It supports Python scripts, which makes it flexible. You could modify any parameters as you want or add additional steps in the script to fit your needs. Personally, I find it's pretty handy for testing race conditions.
Turbo Intruder will let you forget about the Burp Intruder in the Burp Pro version.
Logger++
After a session of testing, you may already have collected hundreds of requests and responses in Logger or HTTP history. Sometimes, you need to search for a specific request with a certain parameter in the request URI path or a specific request with a certain value in the response... It's clearly not an option to go through all the requests and check them one by one. Missing the search function is a big deal in the Burp Suite community edition.
Logger++ provides enhanced search functionality. Among all the features in Logger++, I find its grep tool is the most useful feature. As the name suggested, you could "grep" logs with matched patterns:
If you are using Logger++ already, I'm pretty sure you won't open Burp Logger anymore, and you won't mind using the search functionality in the Burp Pro version either.
Interactsh Collaborator
The Burp Collaborator is a killer tool in the Burp Pro version. It's valuable for testing OOB (Out-of-band), or generating temporary email addresses...
Don't be sad yet if you cannot use Collaborator in the community edition. Because if you know interactsh-collaborator extension, you won't miss a thing.
Interactsh Collaborator provides a good alternative, based on interactsh-client. It offers the same functionalities as the Burp Collaborator does:
LazyCSRF
Last but not least, another feature in Burp Pro you may need is "Generate CSRF PoC". LazyCSRF is an extension to fulfill this purpose with some additional enhancements:
The purpose of this post is not to demotivate you from purchasing the Burp Pro license. Contrarily, if you love Burp Suite and you're able to pay for the Pro license, then please own it properly like a pro.
Here is a list of the mentioned extensions in the post and their GitHub repositories:
- Turbo Intruder: https://github.com/PortSwigger/turbo-intruder
- Logger++: https://github.com/nccgroup/LoggerPlusPlus
- Interactsh-collaborator: https://github.com/wdahlenburg/interactsh-collaborator
- LazyCSRF: https://github.com/tkmru/lazyCSRF
Top comments (0)