Web
Tools

Five Burp Suite tricks that change how you test

Burp's defaults are fine. Burp tuned is a different tool entirely — here's how I configure it before every engagement.

By Hackerscorn Team · May 12, 2026 · 2 min read

Most testers never touch Burp's settings after install. Five small changes compound across an engagement — by the third day, you're moving twice as fast as the version of you who installed the tool last week.

1. Scope before anything else

Define target scope on day one. Burp's scope-aware tools (Repeater history filter, Logger filter, the Issue tracker) only shine if you've drawn the lines. Five minutes of scoping saves five hours of squinting later.

2. Match & Replace for stealth

Stuck behind a WAF? Match & Replace lets you rewrite outbound requests to slip past common signatures without touching every Repeater tab. We use it to:

Strip noisy headers from Active Scan probes
Inject canary tokens into User-Agent for telemetry
Standardize Origin/Referer during testing

3. Project files, not workspaces

Save a project file the moment a target is in scope. It survives crashes, syncs to a shared drive, and resumes across days. Crash recovery from a clean project file is dramatically faster than rebuilding state.

4. Collaborator on every test

Out-of-band findings are some of the highest-impact bugs you'll ever submit. If your workflow doesn't start a Collaborator session by default, you're throwing those bugs away.

5. Treat Repeater like an editor

Rename tabs. Group by endpoint. Use comments. Six hours into testing a complex flow, the tester who treats Repeater like a notebook absolutely smokes the tester who doesn't.

Five Burp Suite tricks that change how you test

Burp's defaults are fine. Burp tuned is a different tool entirely — here's how I configure it before every engagement.

By Hackerscorn Team · May 12, 2026 · 2 min read

1. Scope before anything else

2. Match & Replace for stealth

Stuck behind a WAF? Match & Replace lets you rewrite outbound requests to slip past common signatures without touching every Repeater tab. We use it to:

Strip noisy headers from Active Scan probes
Inject canary tokens into User-Agent for telemetry
Standardize Origin/Referer during testing

3. Project files, not workspaces

4. Collaborator on every test

Out-of-band findings are some of the highest-impact bugs you'll ever submit. If your workflow doesn't start a Collaborator session by default, you're throwing those bugs away.

5. Treat Repeater like an editor

Rename tabs. Group by endpoint. Use comments. Six hours into testing a complex flow, the tester who treats Repeater like a notebook absolutely smokes the tester who doesn't.