Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

How do i replace a value that is sent in multi-part/form-data body of a request?

S | Last updated: Aug 06, 2015 12:58PM UTC

Dear all, I have the following Form data, that is sent through HTTP POST to a site: -----------------------------10935559812996 Content-Disposition: form-data; name="form_id" 1620306976 -----------------------------10935559812996 Content-Disposition: form-data; name="ParameterWhichValueIsToBeChanged" blabla -----------------------------10935559812996 Content-Disposition: form-data; name="someOtherParameter" some other value -----------------------------10935559812996 i want to exchange tha value blabla with yeahyeah, but keep the rest of the request. i use the following regex to match: (.*)ParameterWhichValueIsToBeChanged"\n\n(.*)\n(.*) if i replace it with $1ParameterWhichValueIsToBeChanged"\n\nyeahyeah$3 but burp strips out the slashes an the third group only contains the boundary string (-----------------------------10935559812996). Maybe because it is meant to be a literal string. But it used to work and in addition it kept the whole rest of the request, even after the new lines. Can anyone help me please? Is there perhaps an easier way to replace a value of a certain parameter within multi-part form data? Regards, Simon

PortSwigger Agent | Last updated: Aug 10, 2015 08:05AM UTC

If you are using Proxy match/replace rules, you can select the type "Request param value", and operate solely on that value, so your pattern won't match on any of the surrounding request. Alternatively, you could use a session handling rule with an action to set a specific parameter value.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.