Colonel Clustered Finding Outliers in Burp Intruder

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/colonel-clustered-finding-outliers-in-burp-intruder
• Blog Title: Colonel Clustered: Finding Outliers in Burp Intruder
• Suggested Section: Pentesting Web -> Web Tooling / Burp Suite (or create a new subsection under Pentesting Web for Burp Intruder/Fuzzing result analysis & triage)

🎯 Content Summary

Post: “Colonel Clustered: Finding Outliers in Burp Intruder” (TrustedSec, January 20, 2026) by Drew Kirkpatrick.

Problem being solved (why Intruder misses bugs):
Burp Intruder is commonly used to fuzz inputs and then spot “interesting” results by sorting on Intruder’s built-in columns: response size, status code, content-type, and response time. These are convenient but are weak proxies for the real signal: small differences in response body content that ...

🔧 Technical Details

Content-based outlier detection for fuzzing results: When Intruder responses are too similar for metadata sorting (size/status/content-type/time), tokenize each response body (using tokenizers tailored to content-type/format), optionally pre-group to reduce computation, then cluster request/response pairs by similarity of tokenized content. Outliers become small clusters (often singletons), which can then be confirmed by diffing with Burp Comparer.

Two-stage clustering to balance speed and accuracy: Use a fast DBSCAN-based clustering pass for most datasets, but when misclustering occurs, re-run with a slower similarity-matrix-based clustering (“Deep Analysis”) to more reliably separate true outliers. Provide progress indication and cancellation to keep large fuzzing jobs usable, and avoid running the similarity-matrix approach on very large datasets (e.g., ~10k results) due to runtime.

Parameter auto-calibration using batched datasets: Because Intrud...

🤖 Agent Actions

Updated HackTricks with Colonel Clustered Burp Intruder response clustering guidance and integration:

• Added burp-intruder-response-clustering.md detailing why response-content clustering catches hidden outliers, workflow steps (send Intruder results → fast DBSCAN vs. Deep Analysis similarity matrix → diff with Burp Comparer), performance cautions, and install links.
• Linked the new page from the Web Vulnerabilities Methodology “Web3, Extensions & Tooling” section for easy discovery.

References: TrustedSec blog “Colonel Clustered: Finding Outliers in Burp Intruder” and the tool’s GitHub.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/colonel-clustered-finding-outliers-in-burp-intruder

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Web Tooling / Burp Suite (or create a new subsection under Pentesting Web for Burp Intruder/Fuzzing result analysis & triage)".

Repository Maintenance:

• MD Files Formatting: 940 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0