Fake Antifraud Requests with Burp Suite

[Professor]

The Complete Carder's Guide​

Bro, I add a genuinely powerful piece of material. Burp Suite isn't just a tool — it's the Swiss Army knife for a carder who wants to understand what happens between their browser and the server. Most beginners don't even realize you can intercept, read, and modify the requests that go to anti-fraud systems and feed them any device fingerprint you want.

This guide is not just a translation. It's a complete manual with step-by-step instructions, technical details, strategies, and error fixing.

PART 1: WHAT IS BURP SUITE AND WHY YOU NEED IT​

1.1. How Burp Works​

When you open any website, a two-way conversation happens:

• Your browser (front-end) sends requests to the site's server (back-end)
• The server processes them and sends responses

Burp Suite inserts itself right in the middle of this conversation as a proxy:

• You see every request from the browser
• You see every response from the server
• You can pause, modify, and continue this conversation
• The server has no idea you rewrote the script

1.2. Why This Is Critical for Carding​

When you shop online, your browser doesn't just talk to the main site. It also sends data to hidden anti-fraud systems:

System	Endpoint	What It Checks
Stripe Radar	m.stripe.com	Behavior, fingerprint, history
Forter	forter.com	Device fingerprint, behavior
Riskified	c.riskified.com	Full digital cavity search
Sift	sift.com	Behavioral patterns
Kount	kount.com	Device ID, history
NoFraud	nofraud.com	Basic checks
Signifyd	signifyd.com	Machine learning

Burp lets you intercept and manipulate both types of traffic:

1. Requests to the main site
2. Hidden anti-fraud callbacks

1.3. What You Can Do With Burp​

Capability	Description
Intercept requests	Pause and modify any request
Modify responses	Change server responses
Repeater	Repeat requests with changes
Intruder	Automated brute force
Scanner	Vulnerability scanning (Pro)
Decoder	Encode/decode
Comparer	Compare requests
Extender	Plugins

PART 2: SETTING UP BURP SUITE​

2.1. Choosing a Version​

Version	Price	Pros	Cons
Community	Free	Basic interception	No scanner, limited Intruder
Professional	$475/year	Everything included	Expensive
Pro (crack)	$0	Everything included	Malware risk
Caido	$10/mo	Modern, cheaper	Fewer features
mitmproxy	Free	CLI, flexible	No GUI
OWASP ZAP	Free	Open source	Less convenient

Recommendation: Start with Community, move to Pro when you understand what you need.

2.2. Installation​

Step 1: Download Burp

• Official site: https://portswigger.net/burp/communitydownload
• Or find a Pro version on forums

Step 2: Install Java

• Burp requires Java 11+
• Download from https://adoptium.net

Step 3: Launch Burp

• Windows: BurpSuiteCommunity.exe
• Mac/Linux: java -jar burpsuite.jar

2.3. Proxy Setup​

Step 1: Configure Burp Listener

Proxy → Options → Proxy Listeners
Add → Bind to port: 8080
Bind to address: All interfaces

Step 2: Configure Anti-Detect Browser
In Octo/Linken Sphere/Dolphin:

• Open proxy settings
• HTTP Proxy: 127.0.0.1:8080
• HTTPS Proxy: 127.0.0.1:8080
• SOCKS: don't use (Burp is the proxy)

Step 3: Install Burp Certificate

1. Open https://burp in browser
2. Click "CA Certificate"
3. Download cacert.der
4. Install in browser:
   • Chrome: Settings → Privacy → Security → Manage Certificates → Import
   • Firefox: Settings → Privacy → Certificates → View → Import

Step 4: Verify It Works

• Open any site
• Burp should show the request in HTTP History

2.4. Intercept Setup​

To intercept requests:

Proxy → Intercept → Intercept is ON

To intercept a specific domain:

Proxy → Options → Intercept Client Requests
Add rule: AND domain name matches c.riskified.com

To disable response interception:

Proxy → Options → Intercept Server Responses
Disable

For automatic forward:
[/CODE]
Proxy → Intercept → Intercept is OFF[/CODE]
Requests will be logged but not paused.

PART 3: BYPASSING CVV VIA INTERCEPT​

3.1. The Core Method​

When you submit payment data at checkout, your browser sends a POST request with all card details:

• Card number
• CVV
• Expiry
• Billing ZIP

Using Burp Intercept, you can:

1. Intercept this request before it reaches the server
2. Remove the CVV field or replace it with an empty value
3. Send the modified request

If the merchant's backend verification is weak (and more stores screw this up than you'd think), the payment may still go through without CVV.

3.2. Step-by-Step Instructions​

Step 1: Enable Intercept
text
Proxy → Intercept → Intercept is ON
Step 2: Fill Checkout

• Enter card data (number, expiry, CVV, ZIP)
• Click "Pay" or "Place Order"

Step 3: Intercept the Request

• Burp will pause the request
• You'll see JSON or form-data with card details

Step 4: Modify the Request
Option A: Remove CVV entirely

{"card_number":"4111111111111111","expiry":"12/25","billing_zip":"10001"}

Option B: Replace with empty value

{"card_number":"4111111111111111","expiry":"12/25","cvv":"","billing_zip":"10001"}

Option C: Replace with fake CVV

{"card_number":"4111111111111111","expiry":"12/25","cvv":"000","billing_zip":"10001"}

Option D: Remove CVV from form-data

card_number=4111111111111111&expiry=12/25&billing_zip=10001

Step 5: Send the Request

• Click "Forward"
• Watch the server response

3.3. Why This Works​

Reason	Explanation
CVV is optional	Some payment gateways set CVV as "optional"
Lazy developers	Don't implement backend verification
Outdated SDKs	Old plugin versions don't check CVV
MOTO payments	Mail Order/Telephone Order often without CVV
Recurring payments	Subscriptions often without CVV

3.4. Additional Possibilities​

Change item price:

{"item_id":"12345","price":"0.01","quantity":"1"}

Some stores don't verify price on the backend.

Change quantity:

{"item_id":"12345","price":"100.00","quantity":"100"}

If the store doesn't verify the total.

Change currency:

{"currency":"JPY","amount":"1000"}

Sometimes you can buy an expensive item for "1000 yen" instead of dollars.

Change discount:

{"discount":"100","total":"0.00"}

If the store applies the discount client-side.

Change shipping:

{"shipping_method":"free","shipping_cost":"0.00"}

If shipping is calculated client-side.

PART 4: MODIFYING ANTIFRAUD REQUESTS​

4.1. What Anti-Fraud Systems Collect​

Modern anti-fraud systems are hidden scripts embedded in pages that collect mountains of data:

Category	What's Collected
Browser fingerprint	User agent, resolution, fonts, plugins
Hardware info	GPU (WebGL), CPU cores, RAM
Mouse movements	Speed, trajectory, jitter
Typing rhythm	Typing speed, pauses
Automation detection	Headless browser, Selenium, Puppeteer
Network	IP, DNS, WebRTC
Cookies	History, sessions
Behavioral	Scroll, clicks, time on page
Battery	Level, charging
Screen	Resolution, color depth, pixel ratio
Timezone	Timezone, offset
Language	Language, locale
Touch	Touchscreen presence
Audio	AudioContext fingerprint
Canvas	Canvas fingerprint
WebGL	GPU vendor, renderer

All this data is packaged and sent to servers:

• m.stripe.com — for Stripe
• c.riskified.com — for Riskified
• forter.com — for Forter
• sift.com — for Sift
• kount.com — for Kount

4.2. How They Hide Data​

Method	Description
Base64	Payload encoding
Character substitution	Character replacement (a → x)
JS obfuscation	Code hiding
Data splitting	Splitting across requests
Custom encoding	Proprietary schemes
Encryption	Encryption (rare)
Compression	gzip, brotli

Truth: Security through obscurity doesn't work. Systems must send data in a format the browser can handle. So it can be read.

4.3. Step-by-Step: Riskified on Booking.com​

Step 1: Configure Burp

Proxy → Options → Intercept Client Requests
Add rule: AND domain name matches c.riskified.com
Proxy → Options → Intercept Server Responses
Disable

Step 2: Visit the Site

• Open Booking.com
• Select a flight/hotel
• Go to checkout

Step 3: Intercept the Request

• Burp will pause the request to beacon.riskified.com
• This request loads the JS for fingerprinting
• Then data is sent to c.riskified.com

Step 4: Examine the Payload

• In HTTP logs you'll see an obfuscated payload
• This is your digital DNA

Step 5: Deobfuscation
For Riskified, the payload isn't just Base64. You need reverse engineering.

Tool: BinX (binx.vip)

1. Go to binx.vip
2. Select "Riskified" in the deobfuscator
3. Paste the intercepted payload
4. Get readable JSON

Example deobfuscated payload:

{
"lat": 37.7749,
"timezone": 240,
"timestamp": "1689452187394",
"cart_id": "7629384105",
"shop_id": "cf.bstatic.com",
"referrer": "https://secure.booking.com/",
"riskified_cookie": "p8jkl352qxnrtyuvcbm7fds9ghzwe6",
"color_depth": 24,
"hardware_concurrency": 8,
"has_touch": true,
"history_length": 7,
"document_title": "Booking.com",
"browser": {
"productsub": "20030107",
"is_opr": true,
"is_firefox": false
},
"os": {
"cpu": "Windows NT 10.0",
"platform": "Win32"
},
"webgl": {
"vendor": "Google Inc.",
"renderer": "ANGLE (Intel, Intel(R) UHD Graphics 620, OpenGL 4.5)"
},
"resolution": {
"dpr": 1.5,
"screenh": 1080,
"screenw": 1920,
"availh": 1040,
"availw": 1920,
"innerh": 900,
"innerw": 1600
},
"intl": {
"locale": "en-GB",
"tz": "America/New_York"
},
"nav_lang": "en-GB",
"incognito": {
"safari": true,
"chrome_quota": 120,
"is_brave": true
}
}

Step 6: Modify the Data
Strategic changes to boost trust:

Field	What to Change	Change To
lat	Latitude	Cardholder's billing coordinates
timezone	Timezone	Cardholder's timezone
webgl.renderer	GPU	Popular (NVIDIA, Intel)
resolution	Resolution	Standard (1920x1080)
hardware_concurrency	CPU cores	4, 8 (popular)
has_touch	Touch	true for mobile, false for desktop
browser.is_opr	Opera	false (Chrome is more common)
incognito.is_brave	Brave	false (suspicious)
nav_lang	Language	Cardholder's region language
color_depth	Color depth	24 (standard)
history_length	History	5-15 (normal)

Step 7: Re-Mask
After changes, re-encode the payload using the same method it was encoded with.

Step 8: Send the Request

• Replace the payload in Burp Interceptor
• Click "Forward"

Result: The system links your fake fingerprint to your cookie. It thinks you're a legit customer.

4.4. Other Anti-Fraud Systems​

Stripe Radar:

• Endpoint: m.stripe.com
• Method: Base64 + custom
• Tool: BinX (Stripe)

Forter:

• Endpoint: forter.com
• Method: Custom + JS
• Tool: BinX (coming)

Sift:

• Endpoint: sift.com
• Method: Base64
• Tool: Manual

Kount:

• Endpoint: kount.com
• Method: Custom
• Tool: In development

PART 5: SYSTEM SETUP FOR SUCCESS​

5.1. Infrastructure​

Component	Requirement	Example
Proxy	Residential, IPQS > 80	Bright Data, IPRoyal
Anti-detect	Octo, Linken Sphere, Dolphin	With correct fingerprint
Burp Suite	Pro or Community	With certificate
BinX	Account	For deobfuscation
VPN	None	Don't use

5.2. Burp Configuration for Anti-Fraud​

Step 1: Configure Intercept Rules

Proxy → Options → Intercept Client Requests
Add:
AND domain name matches c.riskified.com
OR domain name matches m.stripe.com
OR domain name matches forter.com
OR domain name matches sift.com
  OR domain name matches kount.com

Step 2: Configure Match/Replace Rules

Proxy → Options → Match and Replace
Add rule:
Type: Request body
Match: "is_brave":true
  Replace: "is_brave":false

Step 3: Configure Logging

Proxy → Options → Misc
Enable logging to file

5.3. Burp Plugins​

Plugin	Purpose	Where
Logger++	Extended logging	BApp Store
JSON Beautifier	JSON formatting	BApp Store
Autorize	Auto auth check	BApp Store
Turbo Intruder	Fast brute force	BApp Store
Custom Payloads	Custom payloads	BApp Store
Hackvertor	Encode/decode	BApp Store
Collaborator Everywhere	SSRF detection	BApp Store

5.4. Anti-Detect Browser Setup​

Octo Browser:

1. Create a new profile
2. Set proxy: 127.0.0.1:8080
3. Install Burp certificate
4. Disable WebRTC
5. Set fingerprint for cardholder

Linken Sphere:

1. Create a new session
2. Set proxy: 127.0.0.1:8080
3. Install Burp certificate
4. Use Hybrid 2.0 fingerprint
5. Configure WebRTC Adaptive

PART 6: COMPARING ANTI-FRAUD SYSTEMS​

System	Bypass Difficulty	Obfuscation Method	Tool	Endpoint
Stripe Radar	High	Base64 + custom	BinX	m.stripe.com
Riskified	Medium	Custom encoding	BinX	c.riskified.com
Forter	High	Custom + JS	BinX (coming)	forter.com
Sift	Medium	Base64	Manual	sift.com
Kount	High	Custom	In development	kount.com
NoFraud	Low	Base64	Manual	nofraud.com
Signifyd	High	ML-based	Hard	signifyd.com

PART 7: MISTAKES AND HOW TO FIX THEM​

7.1. Mistake: Burp Doesn't Intercept HTTPS​

Cause: Burp certificate not installed

Fix:

1. Open https://burp in browser
2. Download CA Certificate
3. Install in browser (Settings → Privacy → Certificates)
4. Restart browser

7.2. Mistake: Payload Won't Deobfuscate​

Cause: Wrong tool or outdated version

Fix:

1. Check which anti-fraud the site uses
2. Use the corresponding tool in BinX
3. If it doesn't work — try manual reverse engineering

7.3. Mistake: Modified Payload Rejected​

Cause: Incorrect re-masking

Fix:

1. Ensure you use the same encoding method
2. Check you didn't add extra characters
3. Compare with the original

7.4. Mistake: Site Still Blocks​

Cause: Anti-fraud uses additional checks

Fix:

1. Check other requests (there may be several)
2. Use anti-detect browser with correct fingerprint
3. Change proxy and cookie

7.5. Mistake: Burp Slows Down Browser​

Cause: Too many requests, large log

Fix:

1. Disable logging for unnecessary domains
2. Use filters
3. Clear HTTP History
4. Increase Java memory

7.6. Mistake: CVV Won't Pass​

Cause: Store verifies CVV on the backend

Fix:

1. Try another store
2. Use Non-CVV BINs
3. Use MOTO payments

7.7. Mistake: Payload Too Large​

Cause: Burp can't handle it

Fix:

1. Increase limit in settings
2. Use Intruder instead of Intercept
3. Split into parts

PART 8: COMPLETE CHECKLIST​

Before Starting:​

• □ Burp Suite installed
• □ Java 11+ installed
• □ Burp certificate installed in browser
• □ Proxy configured (residential)
• □ Anti-detect browser configured
• □ BinX account created
• □ Plugins installed

Before Intercepting:​

• □ Intercept Rules set for anti-fraud domains
• □ Intercept Server Responses disabled
• □ Logging enabled
• □ Match/Replace Rules configured
• □ Proxy works
• □ Certificate works

During Interception:​

• □ Payload intercepted
• □ Deobfuscated
• □ Modified correctly
• □ Re-masked
• □ Sent
• □ Response checked

After Interception:​

• □ Check server response
• □ Log the result
• □ If it didn't work — analyze
• □ Clear HTTP History
• □ Change cookie if needed

PART 9: KEY TAKEAWAYS​

Bro, manipulating anti-fraud systems with Burp Suite is a digital disguise kit.

Key takeaways:

1. Burp is a proxy — it inserts between browser and server
2. CVV can be bypassed — remove or replace the field in the POST request
3. Anti-fraud collects data — but it can be intercepted and modified
4. Deobfuscation is key — use BinX for Riskified, Stripe, Forter
5. Modification boosts trust — change fingerprint to legitimate
6. Combine methods — CVV + anti-fraud + correct fingerprint

Strategy:

• Configure Burp to intercept anti-fraud domains
• Study what data is collected
• Deobfuscate the payload
• Change data to legitimate
• Re-mask and send
• Combine with anti-detect browser

Remember: Effective digital deception isn't about being invisible. It's about looking so normal that no one thinks to check twice.

Risks:

• Burp can be detected by anti-fraud
• Wrong modification can burn the card
• Using cracks can lead to malware
• Without anti-detect, Burp is useless

Risk Mitigation:

• Use residential proxies
• Combine with anti-detect browser
• Don't exceed limits
• Keep a log
• Change fingerprint

Good luck, bro. If anything — ask.