Lion Cipher Lab

Read Burp Repeater responses: change one parameter and learn how the app really works

• AppSec / DevSecOps
• Intermediate
• ~40 min
• Free · no account required

Why it matters

Anyone can send a request through Burp Repeater once. The skill that turns 'I can use Burp' into 'I can assess a target' is the controlled experiment: send a request, change exactly ONE thing, send it again, and read how the response CHANGED. That difference — the delta — is where the app tells you how it really works, because you have held everything else constant. A scanner fires templated payloads and pattern-matches the reply; it cannot reason that THIS id belongs to someone else, that THIS role field is the app's real authorization check, or that THIS total should never have been $1.…

What you'll learn

• differential analysis: changing one variable in a request and reading the response delta
• isolating a single parameter so a response change has exactly one possible cause
• confirming an IDOR from the differential — the same request with a different id returns another user's record, not a 403
• spotting a broken access-control decision made from a client-supplied value (role=user vs role=admin)
• reading an injection signal — an appended single quote turning a 200 into a 500 SQL error
• catching a business-logic flaw where the server trusts a price or quantity the client sent
• reading the four axes of a response delta: status code, Content-Length, body content, and timing
• judgment: when Repeater's manual precision beats a scanner, and confirming vs guessing

Steps in this lab

1. What Repeater is, and why 'change one thing' is the whole technique
2. The ground rule: this only works on an app you are authorised to test
3. Experiment A — change the id, read the delta: is this an IDOR?
4. Experiment B — flip a client-supplied role and watch authorization change
5. Experiment C — append a single quote and read the injection signal
6. Experiment D — the price the server trusts from the client
7. When Repeater's precision beats a scanner — and the discipline that makes it real
8. Do it better — the differential habits that separate signal from noise

Open the full interactive lab →