Which sequence best describes identifying injection flaws in a web application using Burp Suite?

• A. Analyze responses for anomalies after injecting payloads without capturing requests.
• B. Capture requests, analyze parameters, inject test payloads (e.g., tautologies, union-based, time-based), observe responses for anomalies; verify with multiple payload types.
• C. Only use a single payload type and never observe responses.
• D. Skip payload injection and rely on code review.

Answer: (B)

Testing web app injection flaws with Burp Suite requires an active, iterative approach: intercept the traffic, identify vulnerable parameters, and feed crafted payloads to observe how the server responds. Start by capturing requests with Burp's proxy so you can see exactly what data is sent to the server and which parameters are involved. Then inject test payloads such as tautologies (to probe logic bypass), union-based payloads (to try extracting data via a UNION SELECT in the backend), and time-based payloads (to detect blind SQL injection by causing measurable delays). While injecting, watch for anomalies in the responses—unexpected errors, altered content, or timing differences compared to normal requests. Confirm potential vulnerabilities by repeating with different payload types to ensure the observed behavior is consistent and not a server quirk. This approach is the most effective because it uses Burp's capabilities to capture, modify, and analyze traffic, while employing a range of payloads to reveal different injection techniques and reduce false positives. Skipping request capture, using only a single payload, or avoiding payload injection altogether would miss essential steps and likely fail to reveal actual vulnerabilities.