Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Input returned in response (reflected) - detection in response header exclusion

Andrej | Last updated: Jan 03, 2018 03:04PM UTC

I have an environment in which there is request URI always reflected in the response “x-request-path” header. Would it be possible to have an option in Scanner -> Options -> Scan Issues -> Edit detection methods? I would like to see all the instanced in Body (which could lead to XSS or other issues), but at the moment I have too many false positives (1 for each parameter + URL path filename + name if an arbitrary supplied URL parameter). An example: GET /?_=1514990468889osofgagz54 HTTP/1.1 Response: HTTP/1.1 200 OK connection: close content-type: text/html;charset=UTF-8 date: Wed, 03 Jan 2018 14:59:45 GMT ... x-request-path: /?_=1514990468889osofgagz54 ... Thank you

Liam, PortSwigger Agent | Last updated: Jan 08, 2018 08:08AM UTC

We've made a note of this in our development backlog. Unfortunately, we can't provide an ETA. In the meantime, this functionality could be performed by an extension.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.