Burp Repeater: one request, one hypothesis
A method for manual HTTP testing without changing a dozen parameters at once.
Keep a baseline request
In an authorized test environment, perform a normal action in the browser and send its request to Repeater. Replay it unchanged. If the result already differs, investigate session state, single-use values and application state before making further changes.
Change one variable
State your expectation before sending the request: for example, the server should reject an invalid field value. Change only that field, then compare responses. This helps connect an observation to a specific change instead of mistaking a side effect for a vulnerability.
Read the meaning of the response
Compare the status, body, relevant headers and the object’s state after the request. Response length and timing are useful signals, not conclusive evidence. Sometimes the server returns an error after it has already performed the action.
Leave a reproducible trail
Name tabs clearly: baseline request, modified field, post-fix control. Record the role and required preconditions. Before sharing evidence, remove active tokens and personal data from the material.