Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp not scanning json properly

Christian | Last updated: Jun 21, 2018 08:58PM UTC

Hi i'm testing a an application who send his data in json format but scanner from burp is not testing correctly... all payloads send from scanner are place it outside the json post. Ex: {"test":"somedata"}' and '7087'='7087 i tried in version 1.7.21, 1.7.33 and 1.7.34 without any external plugin except for logger++ and i got the same result... i found manually a sqli like {"test":"somadata\' or 1=1"} but I can't get this with burp scanner because he place everything outside of json request... How could I solve this? i'm using java from kali linux: openjdk version "1.8.0_131" OpenJDK Runtime Environment (build 1.8.0_131-8u131-b11-2-b11) OpenJDK 64-Bit Server VM (build 25.131-b11, mixed mode) Cheers. Chris.

PortSwigger Agent | Last updated: Jun 22, 2018 09:47AM UTC

Hi Chris, Thanks for your message. JSON scanning is enabled by default. Please check Scanner > Options > Attack Insertion Points and ensure "Body parameter values" is enabled. Can you send us a screenshot of the request you're scanning? There might be something about that particular request that is causing difficulty. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.