This room covers the Burp modules that support analysis rather than direct attack execution: Decoder for transforming data, Comparer for spotting differences, Sequencer for token randomness testing, and Organizer for saving interesting requests. These modules make manual testing faster and cleaner.
Core idea: Burp is not just Proxy/Repeater/Intruder. These supporting modules help you understand data, compare behavior, assess randomness, and keep your workflow organized.
Decoder is Burp’s data transformation workspace. You can paste values directly into it or send content from other modules with Send to Decoder.
Useful link: Decoder overlaps with what CyberChef is often used for, but keeping the work inside Burp speeds up testing.
Common uses during web testing:
/ → %2F
ASCII → 4153434949Smart Decode example: strings like Burp can be auto-decoded back into plaintext when Burp recognizes the pattern.
Decoder can generate hashsums directly from input values. This is useful for integrity checks, understanding how applications transform data, or quickly testing whether a visible value may be hashed.
Important: MD5 exists in the list but is deprecated for modern security use. It still matters because older applications may still rely on it.
Comparer lets you compare two datasets by words or bytes. This is extremely useful when two responses look similar but one subtle difference determines whether an attack worked.
Typical use case: compare an invalid login response with a suspected successful one to locate the exact part of the page or headers that changed.
The room demonstrates this with the support login flow:
This is a practical way to spot authentication success when page structure is similar and differences are easy to miss manually.
Sequencer tests the randomness of tokens such as session cookies and CSRF values. If tokens are predictable, attackers may be able to guess future values, which can be catastrophic for session management or password reset flows.
Main purpose: assess entropy. High entropy generally means the tokens are hard to predict.
The room uses the admin login form’s loginToken for live capture analysis.
/admin/login/.loginToken.Room guidance: around 10,000 samples gives a much more reliable result than a tiny sample size.
Burp’s report summarizes the effective entropy and the reliability of its estimate.
Interpretation: a report like 117 bits of effective entropy with high confidence strongly suggests the token generation is robust, though statistics are never absolute proof by themselves.
Organizer is Burp’s note-and-storage module for keeping important requests in one place. It is useful during longer assessments when you want a shortlist of findings, proof requests, or follow-up items.
Practical use: save the requests that show vulnerabilities or interesting behavior so you do not lose them in Burp history later.