Burp Suite Workflows skill for Codex
Repeater and Intruder, one variable at a time. This skill drives Burp Suite for authorized testing with the discipline that makes it productive: lock scope first, work from HTTP history, and use Repeater to change exactly one variable per resend. It gives concrete workflows for BOLA, forced browsing, Intruder fuzzing with throttling and JWT tampering, and keeps active scanning inside scope and rate limits.
curl -fsSL codexskills.dev/install.sh \ | sh -s -- burp-suite-workflowsInstalls to ~/.agents/skills/burp-suite-workflows/ for every project on this machine.
curl -fsSL codexskills.dev/cli.mjs -o codex-skills.mjsnode codex-skills.mjs install burp-suite-workflowsThe CLI also searches, updates and removes skills. Run it with no arguments to pick from a list. Needs Node 20.12+.
curl -fsSL codexskills.dev/install.sh \ | sh -s -- --project burp-suite-workflowsInstalls to .agents/skills/burp-suite-workflows/ in the current repository. Commit it and everyone who runs Codex there gets it.
curl -fsSLO codexskills.dev/downloads/burp-suite-workflows.zipunzip -o burp-suite-workflows.zip -d ~/.agents/skills/The archive holds the skill folder with its generated agents/openai.yaml. Unzip into .agents/skills/ to scope it to a repo.
& ([scriptblock]::Create((irm codexskills.dev/install.ps1))) burp-suite-workflowsPowerShell 5.1 or 7. Installs to %USERPROFILE%\.agents\skills\. Add -Project for the current repo.
104-line POSIX script. No sudo, no telemetry. Read install.sh
Use it in Codex
Start a prompt with $burp-suite-workflows, or pick it from /skills.
You can also just describe the task: Codex reads the description below and loads the playbook when your request matches.
What Codex reads before loading it
Drives Burp Suite for authorized web/API testing — proxy capture, Repeater for manual request tampering, Intruder for parameter fuzzing, scope and match/replace, decoder and the scanner — with concrete workflows for IDOR, auth and injection checks. Use when you have written permission to test a target and are working in Burp. Not for testing targets you lack authorization to assess.
Use it when
- You are testing an authorized target using Burp Suite
- You need to tamper requests manually and diff responses
- You want to fuzz a parameter under rate control
Use something else when
- You need the full WSTG web-app checklist: use web-app-pentest
- The target is an API and you want OWASP API coverage: use api-security-testing
- You are mapping the attack surface first: use recon-osint
How to check the result
Reproduce each scanner hit manually in Repeater and diff the tampered response against the untampered baseline before recording it as a finding.
The mistake it prevents
Changing both the object ID and the session token in one Repeater resend, so you cannot tell which change caused the result; or running active scan without confirming scope.
Burp is only as useful as your discipline with scope and Repeater. The point is to capture real traffic, isolate one request, and change exactly one thing at a time to prove a finding. Work only inside written authorization.
Gate 0 — authorization and scope
Confirm written authorization and the exact in-scope hosts before sending traffic. Then set Burp’s Target scope to those hosts and enable “proxy only in-scope items” — this keeps you from accidentally tampering with out-of-scope or third-party traffic. If authorization is missing or ambiguous, stop and ask. Burp needs network access to the target; Codex’s sandbox may require approval for that. For the overall engagement rules, follow pentest-methodology and web-app-pentest.
Setup
- Start Burp; configure the browser to use the Burp proxy (built-in Chromium is simplest) and install Burp’s CA cert so HTTPS intercepts cleanly.
- Set Proxy > Options intercept rules to pause only on in-scope requests; otherwise browsing is painful. Turn intercept off and work from the HTTP history mostly.
- Define scope in Target > Scope with host/path include rules; exclude logout and destructive endpoints you do not want to hit accidentally.
Tool-by-tool
| Tool | Use it for | Key move |
|---|---|---|
| Proxy / HTTP history | Capture everything the app does | Filter by in-scope; right-click → send to Repeater/Intruder |
| Repeater | Manual, one-variable-at-a-time tampering | Duplicate a tab per hypothesis; change one field, resend, diff |
| Intruder | Fuzzing a position (IDs, params, payloads) | Sniper for one position; cluster bomb for combos; throttle rate |
| Decoder / Inspector | Decode/encode tokens, base64, URL, JWT | Inspect and edit JWT claims before replay |
| Comparer | Diff two responses | Confirm auth bypass by diffing allowed vs tampered response |
| Scanner (Pro) | Automated passive/active scan of in-scope | Passive always on; active only within RoE and rate limits |
| Match and Replace | Rewrite headers/body across all traffic | Swap a session cookie to test as another user |
Concrete workflows
IDOR / BOLA with Repeater. Capture a request that fetches an object by ID as user A. Send to Repeater. In a second Repeater tab, replace A’s session cookie/token with user B’s (or use Match and Replace to swap it globally) and change the object ID to A’s. Resend; if B receives A’s object, that is a confirmed BOLA. Use Comparer to diff the two responses.
Forced browsing / function-level auth. Take an admin-only request, send to Repeater, replace the admin token with a normal user’s, resend. A 200 where you expect 403 is a finding.
Parameter fuzzing with Intruder. Send a request to Intruder, mark the target parameter as the payload position (Sniper). Load a payload list (SQLi probes, XSS markers, numeric ID ranges). Throttle the request rate (Resource pool → set a delay) to stay within RoE. Sort results by status code and response length to spot the outlier that behaves differently.
JWT tampering. Copy the token into Decoder/Inspector, decode the payload, edit a claim
(sub, role), test alg:none by stripping the signature, and replay in Repeater.
Confirm whether the server verifies the signature — if a modified token is accepted, that
is critical.
Automating the session for Intruder. When requests need a fresh CSRF token or login, use a session-handling rule (macro) so Intruder requests stay authenticated instead of hitting the login page.
Open redirect / SSRF via Match and Replace. When an app echoes a redirect/next
parameter or fetches a URL server-side, use Repeater to swap in a controlled callback host
(within scope) and watch for the redirect in the response or the inbound request at your
listener (Burp Collaborator in Pro, or any in-scope host you control). One request confirms
the behavior — no need to chain further unless the RoE covers it.
Extensions worth having
Keep the set small; each adds noise. The high-value ones from the BApp Store:
| Extension | Use |
|---|---|
| Autorize | Automates access-control testing — replays every request with a low-priv session and flags where authorization is missing |
| JWT Editor | Decode, edit and re-sign JWTs; test alg confusion and key attacks in-line |
| Param Miner | Discovers hidden/unlinked parameters and headers (cache poisoning, host-header) |
| Logger++ | Searchable, filterable log of all traffic — better evidence trail than raw history |
Autorize is the fastest path to BOLA/function-level findings: set the low-priv session cookie once and browse as admin; it marks each request red (bypassed), green (enforced) or amber (needs review). Confirm every red manually in Repeater before reporting it.
Discipline
- One variable per Repeater resend. If you change the ID and the token, you cannot tell which mattered. Keep a Repeater tab per hypothesis and name them.
- Save the Burp project file; it is your evidence. Export relevant req/resp pairs for the report (mask tokens/PII).
- Keep Intruder rates low and avoid list/bulk endpoints that could mass-mutate data.
- Never run active scan on out-of-scope hosts — scope confines it, but verify before you click “Scan”.
Verification
- Reproduce each finding manually in Repeater after the scanner flags it; the scanner has false positives. State the one-sentence impact.
- Re-send with the original (untampered) request to confirm the baseline behavior differs.
Output contract
Fold findings into the engagement report (security-audit-report / web-app-pentest). Per finding record: the Repeater request (tampered and baseline), the response diff, and the exact tampering step so another tester can reproduce it in Burp.
Hard rules
- Scope first. Active scan and Intruder only against in-scope hosts, within rate limits.
- Throttle Intruder; never use it to brute-force or flood a target beyond the RoE.
- Mask session tokens and PII in any exported evidence.
- No authorization → do not capture or send traffic. Stop and ask.
What the zip contains
SKILL.md plus the interface file below. Nothing runs on install.
agents/openai.yaml
Gives the Codex app a display name, a one-line description and a starter prompt for this skill.
interface:
display_name: "Burp Suite Workflows"
short_description: "Repeater and Intruder, one variable at a time"
default_prompt: "$burp-suite-workflows Walk me through confirming an IDOR in Burp Repeater with two sessions"About this skill
Written and maintained by the Codex Skills editors to the same editorial standard as every skill here: a selective description, a real workflow, known pitfalls and a way to verify the work. First published , last updated . MIT licensed. Something wrong or out of date? Tell us.