Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Replace expired access token in scanner request headers with the valid access token all at once

Ambika | Last updated: Jun 18, 2019 11:36PM UTC

Hi Background : I am trying to scan our website using Burp scanner. I am able to configure session handling rules (https://support.portswigger.net/customer/portal/articles/2363088-configuring-burp-s-session-handling-rules). I have used Burp's extender and python script to successfully replace expired access tokens of the current request (https://www.foregenix.com/blog/testing-problematic-authorisation-tokens-with-burp) Current solution works as below : - Issues current request with expired token - Runs a macro to login again to obtain new access token - Python script replaces expired access token with the valid one - Issues new successful request What I am looking for : - Is there anyway I can optimize this instead of logging in for every request that scanner makes? Like replacing all expired tokens that scanner makes with the valid tokens all at once?

Liam, PortSwigger Agent | Last updated: Jun 19, 2019 09:19AM UTC

Have you tried using the TokenJar extension from the BApp store? - https://portswigger.net/bappstore/d9e05bf81c8f4bae8a5b0b01955c5578

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.