📰 Originally published on SecurityElites — the canonical, fully-updated version of this article.
You’ve been using Burp Suite for a year. You know Proxy, Repeater, and Intruder. You feel reasonably competent. Then you watch a senior bug bounty hunter do a session review and they’re doing things you’ve never seen — requests filtering themselves based on response content, headers injecting automatically into every request, a login macro re-authenticating silently in the background while Intruder runs overnight.
That gap between “knows Burp” and “uses Burp at full capacity” is exactly where most hunters stay permanently. Nobody teaches the 7 Burp Suite Hidden Features that experienced testers use every session. The tutorials cover the three obvious tabs and stop. The rest gets learned by accident or not at all.
I’ve been testing web applications with Burp professionally for years. These seven Burp suite hidden features cut hours from every assessment. Some are built-in, some are extensions. All of them are free. All of them work in Community Edition.
🎯 What You’ll Have After This
Burp Macros configured for automatic re-authentication — run Intruder overnight without session expiry killing your attack
Logger++ capturing traffic that Proxy History misses — including requests from extensions and Scanner
Match & Replace rules injecting bypass headers into every request automatically
Bambdas filtering thousands of requests to the exact ones that matter in seconds
Param Miner finding hidden parameters the application doesn’t document but does process
Organizer replacing your messy external notes file with tracked, exportable findings
⏱️ 20 min read · immediately applicable to your next session ### 📋 7 Burp Suite Hidden Features – Contents 1. Feature 1 — Burp Macros: Automated Re-Authentication 2. Feature 2 — Logger++: Traffic You’re Currently Missing 3. Feature 3 — Match & Replace: Bulk Header Injection 4. Feature 4 — Bambdas: JVM-Powered Request Filtering 5. Feature 5 — Param Miner: Hidden Parameter Discovery 6. Feature 6 — Organizer: Stop Losing Findings 7. Feature 7 — Target Scope: Cut 80% of the Noise ## Feature 1 — Burp Macros: Automated Re-Authentication Here’s the problem Macros solves. You’re running an Intruder attack against an authenticated endpoint. Two hours in, the session expires. Intruder keeps firing requests, but they’re all hitting the login redirect now. You wasted two hours of attack time against the wrong endpoint, and you didn’t notice because Intruder doesn’t care about 302 responses — it just reports them as “success.”
Macros record a login sequence and replay it automatically when Burp detects session expiry. Set one up once and you never babysit a session again. This is the feature that makes overnight Intruder runs viable.
BURP MACROS — SETUP WALKTHROUGHCopy
Step 1: Record the macro
Project Options → Sessions → Macros → Add
Select the login POST request from Proxy History → OK
Macro recorded: POST /login with username=admin&password=X
Step 2: Create Session Handling Rule
Sessions → Session Handling Rules → Add
Rule Actions → Add → Run a macro → select your macro
Scope → Tools: ☑ Intruder ☑ Scanner ☑ Repeater
Scope → URL Scope: Use suite scope
Step 3: Test the macro works
Open Macro Editor → Test macro → verify login response = 200
Add a check — macro should update a session cookie from the response
Macro Editor → Configure item → Cookie/Parameter handling
Extract session_id from login response → use in subsequent requests
The macro doesn’t just log you in — it updates the session cookie from the login response and passes it through to subsequent requests. Get this configured correctly once and your authenticated testing sessions run without interruption regardless of how short the session timeout is.
Feature 2 — Logger++: The Traffic You’re Currently Missing
Proxy History only shows requests that go through Burp’s proxy listener. Logger++ captures everything Burp processes — including requests from extensions, the Scanner, Intruder payloads, and any tool using Burp’s upstream proxy. The traffic you’re missing right now is the traffic that comes from extensions making their own requests in the background.
The other thing Logger++ does that Proxy History doesn’t: it lets you search across all captured traffic using an advanced filter with regex, response keyword matching, and status code conditions simultaneously. Finding the one request in 50,000 that has an interesting response takes seconds instead of manual scrolling.
LOGGER++ — SETUP AND ADVANCED FILTERSCopy
Install Logger++
Extender → BApp Store → search “Logger++” → Install
New tab “Logger” appears → all Burp traffic captured here
Useful filter examples
Show only 200 responses with “password” in response body
Response.status == 200 && Response.body contains “password”
Show requests with non-standard Content-Type headers
Request.headers contains “application/x-www-form-urlencoded”
Show responses with large body (potential data leak)
Response.body.length > 50000
Export filtered results for reporting
Logger++ → Log Table → right-click → Export as CSV
securityelites.com
Logger++ vs Proxy History — What Each Captures
Proxy History — Misses
❌ Extension-generated requests
❌ Intruder requests (only results)
❌ Scanner requests
❌ Collaborator interactions
❌ Out-of-scope requests
❌ Burp-internal requests
Logger++ — Captures
✅ Everything Proxy History shows
✅ Extension-generated requests
✅ All Intruder payloads
✅ All Scanner requests
✅ Configurable scope filtering
✅ Regex-searchable across all fields
📸 Logger++ captures the traffic Proxy History misses — most importantly, requests generated by Burp extensions running in the background. During a complex assessment using multiple extensions simultaneously, Logger++ often shows 3–5× more requests than Proxy History alone. The advanced filter bar lets you search any field with regex or boolean conditions, making it possible to find a specific type of response in a 100,000-request capture in seconds.
📖 Read the complete guide on SecurityElites
This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on SecurityElites →
This article was originally written and published by the SecurityElites team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit SecurityElites.
Top comments (0)