> For the complete documentation index, see [llms.txt](https://infosecgirls.gitbook.io/infosecgirls-training/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecgirls.gitbook.io/infosecgirls-training/appsec/burp-extenders/5-repeater.md).

# Repeater

This is a tool for manually manipulating and reissuing individual HTTP requests, and analyzing the application's responses.

**Assumption:**

* Burp proxy has been configured correctly.
* You are currently logged in to Security Shepherd's admin account.

**Steps:**

1. Log out of Security Shepherd's admin account by clicking on the "Logout" button.

   ![Logout of admin account](/files/-LWHQwpI7WiPWKQqUwd1)
2. On the login page of Security Shepherd application, click on the link labeled as "Security Shepherd Account".

   ![Create new account](/files/-LWHQwpKJjtugSUTgALE)
3. Fill-in the registration form and click on "Sign me up!" button.

   ![Registration form](/files/-LWHQwpM4Y0XadKoxKJl)
4. Login to the newly created (non-admin) account.

   ![Login](/files/-LWHQwpOGqiySYlT0k8M)
5. Click on "Insecure Direct Object References" link in the left navigation menu.
6. In Burp, turn the intercept mode on.
7. In Firefox, click on the "Refresh your Profile" button.

   ![Refresh your profile](/files/-LWHQwpQIXjXWdigo0o0) ![Refresh your profile](/files/-LWHQwpSUASI2WSmMZJL)
8. Go to Burp > "Proxy" > "Intercept" tab, and right-click on the intercepted request.
9. Select "Send to Repeater" from the context menu.

   ![Send to repeater](/files/-LWHQwpUKz1DOmWqNCHT)
10. Switch to "Repeater" tab in Burp.

    ![Switch to repeater](/files/-LWHQwpW3kMBvmZnLZ_g)
11. Click on the "Go" button.

    ![Click on Go](/files/-LWHQwpYcHZDDg3Jc_kz)
12. In the "Request" section, change the value of the "username" parameter to a random value, e.g. `test`, and click on the "Go" button.

    ![Change username](/files/-LWHQwp_9jkI7MqcNpsj)
13. Observe the changes in the response.

    ```
    User: 404 - User Not Found</h2><p>User 'test' could not be found or does not exist.
    ```
14. Change the value of "username" parameter to `admin`, and click on the "Go" button.

    ![Change username to admin](/files/-LWHQwpbyzBfkEgFz7PF)
15. Observe the changes in the response.
16. In "Response" section, enter the keyword "admin" in the search box.
17. Click on plus `+` symbol and select the checkbox labeled as "Auto-scroll to match when text changes".

    ![Search for a keyword](/files/-LWHQwpdlJzX0r72mdO4)
18. To see the previously triggered requests, click on the back arrow symbol.

    ![Move backwards](/files/-LWHQwpf8VqnrmZjsvrK)
19. Use the forward arrow symbol to move to the request that was triggered next, after the currently visible request.

    ![Move forward](/files/-LWHQwphUITX-qlINsv7)
20. Double-click on the tab header to rename a sub-tab in Repeater.

    ![Rename sub-tab](/files/-LWHQwpjoBhUL73l127e) ![Rename sub-tab](/files/-LWHQwplu67A1FPwu8ym)
21. Return to Burp > "Proxy" > "Intercept" tab.
22. Change the value of the "username" parameter to `admin`.

    ![Modify username in Intercept tab](/files/-LWHQwpnFujNlN4zDsAv)
23. Click on "Forward" button.
24. Turn the intercept mode off by clicking on the "Intercept is on" button.
25. In Firefox, you should see the details of the Admin user.
26. Copy the result key by clicking on the "Copy to clipboard" icon.

    ![Copy result key](/files/-LWHQwppMYKimn650Etk)
27. Paste the copied text in the result key input box, and submit the result key by clicking on the "Submit" button.

    ![Submit result key](/files/-LWHQwprngSm4AYHA1h8)