The following steps will guide you to identify and evaluate varied server responses using the Burp Suite Comparer:
- Any anomalous exception to an otherwise consistent response is often worth investigating. Variation in response can often be a solid indication that a payload has produced some desirable result.
- In the previous demonstration of using Burp Suite Intruder to brute-force the login for DVWA, one payload in particular generated a longer response than all the others.
- To evaluate the variation in response, right-click on the event and then click on Send to Comparer (response), as shown in the following screenshot. The same thing should be done for one of the control examples:
- After sending each event to Comparer, you can evaluate them by selecting the Comparer tab at the top of the screen. Ensure that one of the previous responses is selected for item 1 and the other is selected for item 2, as shown in the following screenshot:
- In the bottom-right corner of the screen, there is an option to choose compare words or compare bytes. In this particular case, select the Words option. By doing this, we can see that some of the content modified in the response reveals that the login was successful. Any content that has been modified, deleted, or added is highlighted from one response to the next and makes it very easy to visually compare the two, as shown in the following screenshot:
