1

I would like to get your thoughts/inputs on what approach one can adopt in order to perform penetration testing on a web application which has unique strings appended in every HTTP request. Every response from the server comes with a unique token that is then added (by the client side script) to every request that is made from that page. This means that repeating or fuzzing with burp suite is not an option as the application throws users out with repetitive requests or invalid strings.

Improve this question
2
  • 1
    Is the URL constant for any given page, or does it change at every request?
    – Anders
    Commented Oct 25, 2017 at 7:41
  • @Anders It does change at every request. Every request gets a response from server with another unique string which then gets appended to following http requests by clientside script while redirecting or page submits.
    – iSRC
    Commented Oct 26, 2017 at 5:21

2 Answers 2

Reset to default
5

Burp supports Macros and Session Handling Rules that are designed to cope with this kind of situation. For example, you can configure a macro that fetches a fresh token, and a rule that updates the current request. This can be used with all Burp tools, including Intruder and Scanner. There's some more information here.

The built-in rules cannot update tokens in the URL. However, the Custom Parameter Handler extension lets you do that.

It can be a little bit fiddly to set this up, but it is possible to configure working session rules for most sites. You also have the option of coding your own extension.

Affiliation: Burp Suite is a commercial product of ours.

Improve this answer
6
  • While on-topic and answering the question, please do disclose your affiliation when recommending a commercial product of yours. I've edited the post to include this in an unobtrusive manner.
    – Luc
    Commented Mar 5, 2018 at 7:45
  • 1
    @Luc - I think the affiliation is obvious from the user name, and considering Burp was named in the question it is a stretch to call this a recommendation. I'm going to leave your edit for now. However, please create a meta post before making any further similar edits.
    – PortSwigger
    Commented Mar 5, 2018 at 8:42
  • 2
    Oh darn, I must have mixed up two questions because I remember checking and I found no burp tag in the question. Must have been a different one. Sorry, my mistake. I still think a small note is not bad, but I see your point.
    – Luc
    Commented Mar 5, 2018 at 10:23
  • 1
    Hey @PortSwigger, while it is great that you are here to answer questions regarding Burp, please note that the topic of product support is already covered in the Help center section, specifically here and here. To quote: "However, you must disclose your affiliation in your answers." We welcome your effort here, and while it might be obvious for the experienced user that Burp Suite is a product of PortSwigger, it might not be for newer ones.
    – Tom K.
    Commented Mar 5, 2018 at 10:31
  • 2
    @TomK. your concern has been raised in Meta
    – schroeder ♦
    Commented Mar 5, 2018 at 12:23
0

My approach to this

Write a quick application to ‘index’ the site, using your preferred development language, and export that to a csv file and then import that into your fuzzer as a set of urls to test.

If you don’t have any development skills then you need to find a third party tool or developer to help.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .