The last two lessons worked at the system level: catching a raw shell with netcat, then driving Metasploit against known service vulnerabilities. This lesson steps back to the application layer — where most web testing actually happens. With that post-exploitation context in place, the gap these Burp workflows fill becomes clear: shells give you the system, but stateful web testing requires the tool to keep up with session state and token rotation.
The [intercepting-proxies](/#/) lesson taught you the basics — sit Burp between your browser and the server, pause a request, modify it, and replay it from Repeater. The [fuzzing and Intruder](/#/) lesson taught you to automate a request with a payload list. Those skills are perfect against a single, stateless request.
They fall apart the moment the application is stateful:
- The session cookie expires mid-attack — the server returns a login page or a
401, and every request after that fails. - Every form carries a one-time anti-CSRF token that rotates each load — so a naive Intruder run dies after the first request.
- The interesting endpoint is buried under thousands of noisy requests from analytics, CDNs, and fonts.
This lesson is about keeping complex, stateful testing running without babysitting it — the difference between an automated test that runs unattended against a real app and one that dies after request number one. The tools are Burp's target scope, session-handling rules and macros, dynamic-token extraction, match-and-replace, and the extension (Extender / BApp) ecosystem.
None of these find a new class of bug — they deepen the [intercepting-proxies](/#/) and [fuzzing / Intruder](/#/) workflows you already have so they survive real-world state.
Authorised targets only. Everything here drives automated traffic — macros replay logins, session-handling rules re-fire requests, Intruder and the scanner generate volume. Run it only against a target you are authorised to test: the embedded NovaCart in this lab, a deliberately vulnerable app you control, or your own authorised program. Burp's active scanner sends attack payloads and must never be pointed at a target you are not cleared to test — revisit [Hacking Ethics and Authorization](/#/) if you are unsure. Choose one of those authorised practice targets before starting; Burp Suite Community works for most of the lesson (note the Intruder throttle and macro/scanner limits called out later).
In this lesson you will:
- Set target scope to cut noise and constrain your tools.
- Record a login macro and a session-handling rule so Repeater / Intruder / Scanner auto-re-authenticate when the session drops.
- See how to extract a fresh CSRF token from one response and insert it into the next so automation works against protected forms.
- Learn match-and-replace and the extension ecosystem (Autorize, Logger++, Turbo Intruder), and when to script instead.
Click Continue when you are ready.