Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

removeParameter API outputs incorrect request when removing the last Cookie

webpentest | Last updated: Jun 22, 2017 08:14PM UTC

There is an API to remove a parameter from a given request in IExtensionHelpers interface (https://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html#removeParameter(byte[],%20burp.IParameter)). I use this API in a custom extension that performs request minimization (https://github.com/ngo/burp-request-minimizer/blob/master/minimizer.py). I often get a corner case when no cookies are actually required for the request, so my extension removes all of them. This results in a request with an empty Cookie: header, like the following: POST / HTTP/1.1 ... Cookie: param1=value1... The correct behavior would be to remove the empty header entirely.

PortSwigger Agent | Last updated: Jun 23, 2017 07:50AM UTC

Thanks for reporting the issue. I've added a story to our backlog. Realistically though, it will be some time until we look at this. In the meantime, you should be able to check for an empty cookie header in your Python code. Your extension is a nice touch. Would you be interested in publishing it on the BApp store?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.