CompTIA PenTest+ (PT0-003)Attacks and ExploitsMedium
A penetration tester is analyzing a web application that uses a custom API. They observe that user input is directly embedded into a URL path, like `/api/v1/users/lookup/JohnDoe`. The tester suspects that path traversal might be possible to access sensitive files outside the intended directory. Which of the following Burp Suite features would be most effective for systematically testing various path traversal payloads against this endpoint?
- ARepeater, to manually send modified requests.
- BComparer, to identify differences between responses.
- CSequencer, to analyze randomness of session tokens.
- DIntruder, configured with a payload list of path traversal sequences.
Show answer & explanationAnswer & explanation
Correct answer: D. Intruder, configured with a payload list of path traversal sequences.
Burp Suite's Intruder tool is designed for automated, systematic attacks with custom payloads. For testing path traversal, a payload set containing various `../` sequences and other path manipulation strings can be configured in Intruder to automatically try each one against the target URL path, making it the most effective feature for this task.
Why the other options are wrong
- A. Repeater is for manual testing of individual requests, not systematic testing of many payloads.
- B. Comparer is for comparing responses, which might be useful after Intruder, but not for generating the attacks themselves.
- C. Sequencer is used for analyzing the randomness of tokens, unrelated to path traversal.
Burp Suite Intruder (Path Traversal)
Using Burp Suite's Intruder tool to automate the testing of path traversal vulnerabilities by systematically injecting various directory traversal sequences (e.g., `../`, `..%2f`) into URL paths or parameters.
- Allows defining payload positions and types.
- Can use built-in or custom wordlists for payloads.
- Automates sending many requests and analyzing responses for indicators of success.
- Effective for brute-forcing and systematic fuzzing.
Memory trick: Intruder attacks with multiple payloads, methodically.