Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Request / Response times

Tester | Last updated: Feb 09, 2017 01:24PM UTC

It would be cool if the scanner, repeater and other functionality would show the page's response time. This would be useful to assess blind SQLi timing attacks easier.

Liam, PortSwigger Agent | Last updated: Feb 09, 2017 01:25PM UTC

Hi Thanks for your message. In the Intruder you can select that during the attack under 'columns'; either select 'response received' or 'response completed'. Burp Repeater shows it by default in the lower right corner. Burp Scanner does show the response times when reporting blind SQLi based on time-delay vectors. The times are mentioned in the customised issue advisory. Please let us know if you need any further assistance.

Liam, PortSwigger Agent | Last updated: Feb 09, 2017 01:26PM UTC

The difference between received and completed can depend on the size of the response and the connection speed. How large is the difference are you encountering?

Burp User | Last updated: Apr 11, 2019 07:40AM UTC

Hi, I a bewildered by why the timing shown in repeater is different from the Intruder 'Response received' or 'Response Completed' by quite a mile off, even when issuing the exact same request. Any assistance would be greatly appreciated.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.