Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Content-location ip versus hostname

Andrew | Last updated: Nov 16, 2015 10:37PM UTC

Curious behavior difference between nikto output and burp output. From nikto a request like this: GET / HTTP/1.1 User-Agent: Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:headers: IIS internal IP) Connection: Keep-Alive Host: something.com Has a response including this header: content-location: http://foo.bar.foo.bar:8443/index.htm But in burp when this same request is made the response is: Content-Location: http://something.com/index.htm The internal ip address had been replaced with a domain name. I wondered if Burp was doing some kind of dns lookup during the response processing? Is this possible? Curious, Andrew

PortSwigger Agent | Last updated: Nov 18, 2015 11:32AM UTC

Burp doesn't do any modification of the Content-location header in responses. It sounds like there must be some difference between the requests that are being sent by Burp and nikto, which would explain the difference in the responses.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.