Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Parameter scope questions

Andrej | Last updated: Feb 11, 2019 03:03PM UTC

Hi, when I go to Session handling rule editor -> Scope -> Parameter Scope -> "Restrict to requests containing these parameters". I want to ask, when I specify multiple parameters at the same time => is there logical AND or logical OR between? I mean, does my request need all of the mentioned parameters to have session handling rule applied, or either one of specified is sufficient? Very similar question for my usecase (in the same tab), when I use Custom URL Scope -> advanced scope control -> when I specify regexp for File, does it also take into consideration parameters? I'm asking if I could use File with this regexp: \/html\/path\/index\.html\?(.*csrf=.*)|\/html\/path\/index\.html\?(.*token=.*) Thanks

PortSwigger Agent | Last updated: Feb 11, 2019 04:35PM UTC

It is a logical AND - all the parameters must be present for it to be in scope. And yes the file section does include the query string. I believe you regex will work - although I've not tested myself.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.