Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Missing identification of response splitting vulnerability

Maurizio | Last updated: Jun 22, 2015 09:00AM UTC

We found a that Burp Suite it doesn't test response splitting vulnerability. For example: www.example.com/about.php?date=%0D%0ATest%3A%20no If the HTTP response get the additional header "Test: no" should be reported. https://www.owasp.org/index.php/HTTP_Response_Splitting Regards

PortSwigger Agent | Last updated: Jul 20, 2015 03:18PM UTC

Sorry for the slow reply to this ticket. Burp does check for HTTP response splitting in the active scanner (and calls it "HTTP response header injection"). This looks like a simple vanilla case, and Burp certainly finds cases like this in our testing. If you have any more details about the issue that was not reported, please let us know.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.