Julien Voisin’s post discusses Burp Suite, the popular web application security testing tool, and how to detect and annoy the people using it.
On the detection side, a page can fetch Burp’s default favicon from the proxy listener, check whether a TLS certificate was issued by PortSwigger, or match Burp’s JA3 fingerprint.
The annoyances include endless chunked responses that Burp waits on forever, emoji URLs that mangle the crawler’s sitemap, and a § in signed blobs that Intruder cannot send.
While the post is written in a humorous tone, it does provide useful information on how to detect and mitigate the use of Burp Suite against your web application.
A 2022 write-up shows how little the favicon check takes: an image pointing at http://burp/favicon.ico whose onload handler only fires when the proxy is in the path.
One tell has an expiry date, as PortSwigger added Brotli to Burp’s supported compression types in September 2023.
