Swapper – A Pure Regex Match/Replace Burp Extension Penetration Tester. Developer. Pure GNU/Linux Phone Enthusiast. There are a thousand (rough guess) different ways in Burp Suite to swap out session token values when using something like Intruder or the Scanner. But what about the edge cases? Recently, I tested an application that used SOAP-based XML requests. The session token was only used once...