Comparer

Next in our tools for Burp Suite is Comparer. Comparer is simply a tool to compare to HTTP requests or responses.

Comparer is useful when you want to see how different values for parameters and headers enable subtle changes in the responses that you receive. It is useful to see how the application reacts to a valid user, invalid password combination compared to an invalid user and invalid password combination. This can aid in enumerating usernames.

Consider that a web application gives an informational error, such as a wrong password for a given username. All I need to do is supply different usernames, and for all those times, if I get the mentioned error, I will know for sure that those usernames exist in the web application.

Many times with Blind SQL injection, there can be tiny differences in HTTP responses, and the tool can help you identify exactly what is different.

We start by using the context menu to send either the HTTP request or response to the Comparer. have a look at the...