Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Best approach for web-application testing with a webservice.

Matt | Last updated: Sep 08, 2015 02:50PM UTC

The data flow works like this: Browser -> Application -> Webservice -> Application -> Browser I'd like to be able to fuzz the flow where the webservice is sending data back to the application so that I can attack the browser. While I'm aware I can route all traffic through the same instance of Burp, what I need is a passive fuzzing, where I can send the same request from the browser and have the fuzzer do its job on responses instead of on requests. Is this even possible?

PortSwigger Agent | Last updated: Sep 09, 2015 08:29AM UTC

Burp's functions for scanning/fuzzing are designed around making changes to requests and analyzing the resulting responses. There isn't an obvious way to use Burp Scanner or Intruder to fuzz resposnes to perform attacks against the client. It sounds like a good approach would be to write an extension that hooks traffic through Burp Proxy and makes whatever changes you want to responses.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.