Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Header lines with improper terminators manipulated by Burp in strange ways

David | Last updated: Oct 29, 2017 12:54AM UTC

I'm currently testing an embedded device with a cgi-script that terminates header lines with only '\n', and '\n\n' at the end of all headers. While not RFC-compliant, browsers seem to handle this just fine. However, when it goes through Burp, the '\n\n' is replaced with '\n\r\n\r\n', which the browser interprets as *3* newlines, causing an extra newline to appear in the browser, breaking the parsing of the responses to XHRs. Tested on 1.7.27 free, can test on pro at work next week.

PortSwigger Agent | Last updated: Oct 30, 2017 10:59AM UTC

Hi David, Thanks for reporting this. I've had a look and can reproduce the issue. This is a bug in Burp and we will endeavor to fix this. In the meantime, this extension should provide a workaround: - https://gist.github.com/pajswigger/1f595793390e0badace669c4b7f7fc98 Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.