Every once in a while I come across the same scenario which is difficult and frustrating to test:

1. Inject payload in one endpoint (POST/PUT)

2. Check reflected payload in another endpoint (GET)

3. Each new injected payload overrides the previous one (!)

Therefore running a full intruder on the POST/PUT endpoint and then using the GET endpoint will only be relevant for the last payload sent.

So how do we fix this without manually sending the payload and reading the output with 2 different repeater tabs?

Solution

1. Have 2 different intruders (one for POST/PUT and one for GET)

2. Set the concurrent requests to 1

3. Set the delay between requests to 5000 milliseconds (5 seconds)

4. For the GET request, use the same payload list used in the POST/PUT, but place it in a dummy request header. This will make it possible for you to see which payload reflected a specific output and match the number of requests

5. Start the POST/PUT intruder

6. Wait ~2-3 seconds

7. Start the GET intruder

Once the attacks are done, you have the intruder results showing all reflected payloads, not just the last one sent:

1. Configuration of POST/PUT Intruder

2. Configuration of GET Intruder