In our last lesson, you took a crucial first step into the world of web security testing by learning how to configure and use Burp Suite to intercept and inspect HTTP traffic. You now know how to act as a "man-in-the-middle," pausing requests as they leave your browser. While this is powerful, it can be inefficient if you want to test many variations of a single request.
This lesson builds directly on that foundation. We will introduce Burp Repeater, a tool designed specifically for the task of modifying and replaying HTTP requests. Instead of intercepting traffic over and over, you will learn to send a single request to Repeater and then manipulate and resend it as many times as you like, all while carefully observing how the server responds to each change. Mastering this workflow is not just an incremental improvement; it is the core activity of a bug bounty hunter.
From Intercepting to Replaying: The Role of Burp Repeater
In the previous lesson, you used the Proxy > Intercept tab. Think of this as a single-use checkpoint. You can stop a request, change it, and send it on its way. But what if you want to test a password field for 20 different common passwords? Or what if you want to see how a server handles slightly different values in a user ID parameter? Intercepting each attempt would be slow and tedious.
This is where Burp Repeater comes in. It provides a dedicated workspace to take a single, interesting request and use it as a template for experimentation. You can tweak headers, change parameter values, or alter the request body, and instantly see the server's response to each modification.
The following video introduces the purpose of Repeater and why it is so invaluable for security testing.
Burp Suite Repeater Module | Jr. PenTester EP18 | TryHackMe Burp Suite for Beginners
Watch this introductory segment from the "Burp Suite Repeater Module" video by Hank Hackerson.
Focus on the core explanation of what Repeater does: it enables you to modify and resend intercepted requests repeatedly, providing a much more efficient testing environment than other methods.
The Basic Workflow: From Proxy to Repeater
Your journey into testing a specific request almost always begins in another part of Burp Suite. You might find a request of interest while browsing a site (logged in your Proxy > HTTP history) or by actively intercepting it. Once you've identified a request you want to analyze further, you send it to Repeater.
This is a fundamental action in Burp Suite, and it's very simple to do.
How to resend individual requests with Burp Repeater
This official video from PortSwigger, "How to resend individual requests with Burp Repeater," demonstrates the standard workflow.
First, watch the different ways you can send a request to Repeater from other Burp tools like Proxy History or the Target tab. The most common method is to right-click a request and choose "Send to Repeater". The keyboard shortcut is Ctrl+R (or Cmd+R on Mac). Next, observe the basic interaction: the request appears on the left, you can edit it, click "Send", and the server's response appears on the right.
When you send a request to Repeater, it opens in a new tab. On the left is the editable raw request, and on the right is the (initially empty) response panel. When you click the "Send" button, Burp sends the request from the left panel to the target server and displays the full response on the right. You are now free to make any changes you want to the request and resend it as many times as you need, directly comparing the different responses.
Making Precise Changes with the Inspector
While you can edit the raw text of a request directly, this can become difficult with large, complex requests. It's easy to make a syntax error or miss a crucial parameter buried in a long string of text.
To solve this, Burp provides the Inspector tool. The Inspector, available within Repeater and other Burp tools, gives you a structured, user-friendly view of all the components of a request and response. You can view and edit headers, query parameters, and body parameters in a simple table format, without having to manually edit the raw text.
The following video provides an excellent deep dive into using the Inspector.
Burp Suite Repeater Module | Jr. PenTester EP18 | TryHackMe Burp Suite for Beginners
Return to the Hank Hackerson video for a detailed walkthrough of the Inspector.
This is a rich segment, so pay close attention. First, get an overview of the Inspector's purpose and how it breaks down requests into organized elements. Next, learn about the different sections, particularly Request Attributes (method, path, protocol) and the distinction between URL query parameters and body parameters. Crucially, understand the explanation of what a parameter is (a key/value pair). This is a fundamental concept in web development and hacking. Finally, watch the practical demonstration of how the Inspector displays body parameters from a form submission, and how you can edit them directly in the Inspector interface.
Practical Exercise: Modifying a Header
Now let's apply this knowledge. A common test case is to add a custom HTTP header to a request to see if the server behaves differently. Some applications might expose hidden features or debugging information if a specific header is present.
The next segment of the video walks you through a practical challenge where you do exactly this to retrieve a hidden flag. Follow along and perform the steps in your own Burp Suite instance.
Burp Suite Repeater Module | Jr. PenTester EP18 | TryHackMe Burp Suite for Beginners
This is a hands-on exercise from the video. Follow the steps to retrieve a flag.
The goal is to add a header named flag-authorized with a value of true. Capture a request to the homepage of the target site and send it to Repeater. Use the Request Headers section in the Inspector to add the new header. Be careful to add it to the headers, not the query parameters. Send the modified request and inspect the response body to find the flag. The video shows the exact process and the successful result.
A Glimpse of What's to Come
So far, we've modified simple headers. The real power of Repeater is unleashed when you start probing for complex vulnerabilities by manipulating the application's logic. One of the most common and impactful vulnerability classes is SQL Injection, where an attacker sends malicious database commands through a normal user input field.
You are not expected to understand the intricacies of the attack shown in the next video clip—we will cover SQL Injection in detail in Module 5. The purpose of watching this is to see how Repeater is used in a real-world scenario.
Burp Suite Repeater Module | Jr. PenTester EP18 | TryHackMe Burp Suite for Beginners
Watch this final segment from the Hank Hackerson video, which demonstrates an SQL Injection attack using Repeater.
Focus on the process, not the specific code. Notice how the first step is to test for the vulnerability by sending a single apostrophe in a parameter (/about/2') and observing the "Internal Server Error" response. This is a classic sign of a potential SQL injection flaw. Observe how the attacker uses the error message to understand the database structure and then crafts a complex payload to list all the columns in the database table. Finally, see the final payload being constructed and sent to extract the specific piece of data (the flag) from the notes column. The key takeaway is the iterative nature of the attack: send a payload, analyze the response, refine the payload, and repeat. This is the essence of manual web application testing, and Repeater is the tool that makes it possible.
Conclusion
In this lesson, you have moved from a passive observer to an active experimenter. You learned how to take any HTTP request and use Burp Repeater as your laboratory to modify it, resend it, and analyze the server's responses. This is a cornerstone skill for finding and confirming almost every type of web vulnerability.
Key Takeaways:
- Burp Repeater is used for modifying and replaying individual HTTP requests to test server responses efficiently.
- The standard workflow is to find a request in Proxy History (or elsewhere), right-click, and "Send to Repeater".
- The Inspector provides a structured way to view and edit request components like headers and parameters, which is much easier than editing raw text.
- The core testing loop is: Modify -> Send -> Analyze Response -> Repeat. This iterative process is fundamental to bug bounty hunting.
You have now completed the foundational module on networking and HTTP for hackers. You understand how the web communicates, the security policies that govern it, and you have the essential tools to intercept and manipulate that communication.
In our next module, "Reconnaissance and Information Gathering," we will take a step back from individual requests and look at the bigger picture. You'll learn how to discover the assets owned by a target—their subdomains, hidden directories, and web technologies—to map out your attack surface before you start probing for vulnerabilities.