Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Determining number of requests/attacks made

Karthik | Last updated: Jul 10, 2015 01:07PM UTC

I am scanning two websites for XSS attacks (or any other test) only One is ASP.net and other is PHP. Lets say I am testing only URL parameter value and in both the cases there 5 parameters each Question 1: For both the websites, number of attack requests sent will be the same or the number of requests will differ ? (since they have same number of parameters) Question 2: If the number of requests are not the same, will the requests that have to be made against each, determined by Burp in the run time ?

PortSwigger Agent | Last updated: Jul 10, 2015 03:19PM UTC

Burp Scanner might make different numbers of requests even in a case where two requests have the same number of parameters for various reasons: - Some checks are selected or refined based on the base/original value of request parameters. - Virtually all active checks select what requests to make based on interactions with the target and the responses received, so different server-side behavior will lead to different requests.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.