Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Inconsistent Site Map behaviour / missing requests

Michael | Last updated: May 17, 2018 10:10AM UTC

Our Burp Suite (latest professional, default settings, no extensions) "Site map" shows an inconsistent behavior for displaying or hiding requests (without filter, i.e. "Showing all items"). According to the documentation the Site Maps shows "All of the resources that have been directly requested via the Proxy." [1] However, the behavior differs between request methods and content: 1) GET www.example.com/test 2) PUT www.example.com/test 3) OPTIONS www.example.com/test 4) POST www.example.com/test (payload xy) 5) POST www.example.com/test?x=0 (payload xy) 6) POST www.example.com/test?x=0 (payload aa) 7) OPTIONS www.example.com/test?x=0 8) GET www.example.com/test?x=0 9) GET www.example.com/test?x=1 10) POST www.example.com/test?x=1 (payload aa) Requests 2,3,8, and 10 are not shown in the site map. That is: POST requests are shown for all URLs (new or existing) if the payload changed. All other requests are only shown if the URL including parameters was not requested before or the existing requests was a POST request. This behavior is confusing. I would expect to see also requests to the same resource / URL if the request method (GET, PUT, DELETE, OPTIONS, etc.) was different. [1] https://portswigger.net/burp/help/target_sitemap

PortSwigger Agent | Last updated: May 17, 2018 10:11AM UTC

Hi Michael, Thanks for reporting this. As you've noticed, the current site map design is very much based on the URL and does not account well for methods other than POST. With REST APIs being more common, this limitation is being hit by more of our users. We do intend to rectify this in the future, but unfortunately it involves some non-trivial reworking of the site map internals. In the meantime, I recommend you make more use of the proxy history. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.