Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

session handling rule set parameter value in json

Wouter | Last updated: Nov 19, 2018 08:44AM UTC

For Burp Suite 2.0.12beta: A session handling rule (Project Options -> Sessions) that takes care of setting the value of a given parameter in http requests is not applied to request bodies in json format. In the request example below, I have tried to replace the value of the parameter "_csrf": POST /api/bla/info/update HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://example.com/bla Content-Type: application/json;charset=utf-8 Content-Length: 336 Connection: close Cookie: rack.session=bla; {"block_info":{"id":80466,"caseholder":22,"report_year":2000,"extra_info":"adsfafa","polelength":100,"coverage":50,"type_of_foundation":"Test fundering","type_of_mat":"Onbekend","dry_period":true,"dummy_ready":false,"collecting_information_ready":true},"_csrf":"yKvR059TxRxH4oCGfu9kljdfCevF7PACuHyzVYAAs="} which did not work. Furthermore, sending the above request to the repeater and clicking the "Params" tab also revealed that the parameters in the json request body are not recognized.

PortSwigger Agent | Last updated: Nov 19, 2018 09:05AM UTC

The built-in session handling rules aren't able to update JSON parameters. However, there are a number of extensions that add capabilities to the built-in functionality. For example, the Custom Parameter Handler extensions, which is in the BApp Store, can do this.

Burp User | Last updated: Nov 19, 2018 12:11PM UTC

Any plans to include this functionality in burp suite? In my opinion this is basic functionality.

PortSwigger Agent | Last updated: Nov 19, 2018 01:56PM UTC

Not in the short term. The plan is to take away the need for session handling rules by having the new crawler maintain state automatically. Because of this there's not much appetite for working on session handling rules at the moment.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.