Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Comparing Scan Responses

Matthew | Last updated: Apr 16, 2021 09:54PM UTC

Is there a native feature or add-on which will compare the same request payload against two different scans? I know the comparer will do this but it's too granular and I am looking for a way to do this for a large number of requests. For example i want to see how two different WAF's would handle blocking the same payloads. I also want to see how proxies and load balances would handle different payloads. Any suggestions on doing that with burp? Could i load up my payloads in intruder and compare responses in some way?

Uthman, PortSwigger Agent | Last updated: Apr 19, 2021 08:23AM UTC

It sounds like the Comparer would be the best way to do this since if you tried to do this in the Intruder, you would need to run two separate attacks before making the comparison between responses. One of the most useful plugins I can think of in relation to comparison of requests/responses is 'Auth Analyzer' but it does not seem like this would fully meet your requirements. Have you considered creating your own extension using the Extender API? - https://portswigger.net/burp/extender#SampleExtensions - https://portswigger.net/burp/extender/api/

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.