Why I Stopped Fighting Burp and Built My Own Listener
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A pentester shares how Burp Suite repeatedly failed during a financial app assessment due to an unstable network that couldn't tolerate a man-in-the-middle proxy. After three lost days, they built a lightweight alternative: a browser extension that captures traffic and forwards it to a local listener, keeping capture and storage separate to avoid performance issues. The approach revealed serious broken access control vulnerabilities — sales accounts could hit admin endpoints like changing passwords, disabling 2FA, and creating bank records — because the frontend enforced roles but the backend did not. Key takeaways: a proxy is optional, the browser already sees all traffic, and comparing endpoint lists across roles is more effective than manual clicking.
Table of contents
Three Days of NothingWhat Actually HelpedFirst Try: A Browser ExtensionSecond Try: Capture Here, Store ThereWhat It FoundThe Short VersionQuestions this post answers
How do I capture HTTP traffic for pentesting when Burp Suite keeps timing out or failing to intercept?
When a proxy like Burp Suite makes an unstable network worse by sitting in the request path, a passive approach works better. A browser extension can capture every request the browser sees and immediately forward it to a local listener on a port — no interception, no decryption overhead. The listener saves each request/response as a JSON line. CORS preflight handling must be added to the listener or every send will fail silently. Pentesters dealing with hostile proxy environments share workarounds like this on daily.dev.
What is the most effective way to find broken access control (IDOR/privilege escalation) across roles in a web app?
Crawl the application fully as each role separately and export the complete list of endpoints each role touches. Then compare the two lists: any endpoint reachable by the privileged role but not the lower role becomes a test candidate — replay those requests using the lower-privileged account's token. This method found multiple critical issues in a financial app, including password changes, 2FA disabling, and bank record creation, all accessible to a sales account. Broken access control patterns like this come up repeatedly — developers building auth systems track them on daily.dev.