7 Hidden Burp Suite Features That Save Hours of Manual Testing (2026)

Feature 1 — Burp Macros: Automated Re-Authentication

Here’s the problem Macros solves. You’re running an Intruder attack against an authenticated endpoint. Two hours in, the session expires. Intruder keeps firing requests, but they’re all hitting the login redirect now. You wasted two hours of attack time against the wrong endpoint, and you didn’t notice because Intruder doesn’t care about 302 responses — it just reports them as “success.”

Macros record a login sequence and replay it automatically when Burp detects session expiry. Set one up once and you never babysit a session again. This is the feature that makes overnight Intruder runs viable.

The macro doesn’t just log you in — it updates the session cookie from the login response and passes it through to subsequent requests. Get this configured correctly once and your authenticated testing sessions run without interruption regardless of how short the session timeout is.

Feature 2 — Logger++: The Traffic You’re Currently Missing

Proxy History only shows requests that go through Burp’s proxy listener. Logger++ captures everything Burp processes — including requests from extensions, the Scanner, Intruder payloads, and any tool using Burp’s upstream proxy. The traffic you’re missing right now is the traffic that comes from extensions making their own requests in the background.

The other thing Logger++ does that Proxy History doesn’t: it lets you search across all captured traffic using an advanced filter with regex, response keyword matching, and status code conditions simultaneously. Finding the one request in 50,000 that has an interesting response takes seconds instead of manual scrolling.

Feature 3 — Match & Replace: Bulk Header Injection

Every time you test a WAF bypass or an IP-based access control, you’re probably adding X-Forwarded-For headers manually in Repeater. Once per request. Which means you’re doing it hundreds of times per session. Match & Replace injects that header into every request Burp processes automatically — set it once, test all day.

The same feature handles any systematic modification you need across all traffic: stripping security headers to test CSP bypass, replacing User-Agent strings for access control testing, adding custom authentication tokens to every request. Stack multiple rules and Burp transforms every request before it leaves your machine.

Feature 4 — Bambdas: JVM-Powered Request Filtering

Regular Proxy History filters are binary — show or hide by status code, method, extension. Bambdas give you a full Java lambda to express any condition. The response body is longer than 10KB AND contains the string “password” AND the request path starts with “/api/”? That’s three lines of Bambda. The equivalent manual filter doesn’t exist.

I started using Bambdas the first week they were released and immediately found a finding I’d missed manually — a response that contained a base64-encoded JWT in an unusual field, which I only spotted because I wrote a Bambda to flag any response containing a three-segment dot-separated string in the body. Five minutes of Bambda writing surfaced a credential leak that a full manual review missed.

Feature 5 — Param Miner: Hidden Parameter Discovery

Every application has parameters it processes but doesn’t advertise. Debug flags. Admin overrides. Feature toggles left in from development. Param Miner finds them by sending your request with hundreds of additional parameter names and comparing responses — anything that differs from the baseline response indicates the application processed the parameter.

The best Param Miner find I’ve had was a hidden debug=true parameter that switched an API endpoint from returning sanitised output to returning raw database rows including fields the application was supposed to hide. The endpoint was in scope, the parameter wasn’t documented anywhere, and automated scanners passed it completely. Param Miner flagged it in four minutes.

Feature 6 — Organizer: Stop Losing Findings

Every tester has done this: found something interesting three hours into a session, made a mental note, kept testing, and by the end had a Proxy History with 80,000 requests and zero memory of which one had the suspicious response. Organizer solves this. Right-click any request and send it there. Add a note. Mark a severity. Your findings are tracked in the project file and never lost.

I switched to Organizer the week it shipped and stopped keeping a separate notes file entirely. The finding stays attached to the actual request, the request is in the project, the project is the report. When you export at the end of the session you have every interesting request with your notes already attached.

Feature 7 — Target Scope: Cut 80% of the Noise

A modern web application makes requests to Google Analytics, Facebook Pixel, Cloudflare, CDN endpoints, and a dozen other third-party services on every page load. None of those are in scope. All of them flood your Proxy History, slow down your Logger++, and make finding interesting requests significantly harder.

A properly configured Target Scope drops out-of-scope traffic before it reaches Proxy History. What remains is only the application you’re testing. On a complex application this is the difference between a 50,000-request history and a 6,000-request history — same session, same testing, dramatically cleaner working environment.

Putting All 7 Together — The Start-of-Session Checklist

The reason most hunters never discover these features is that there’s no obvious moment when you’d look for them. Macros aren’t visible unless you run into a session expiry problem. Bambdas don’t exist until you need to filter something complex. Organizer seems optional until you lose a finding.

The solution is a five-minute start-of-session setup that activates all seven before you write a single request. Once this is habit, these features are just part of how Burp works — not something you remember to configure when you run into a problem.