Auto-login to refresh token in Burp Suite 2

Question

I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the parameters in the request, I show it which parameter corresponds to the login and password then I inform it of the different accounts I have at my disposal (login / password). Thanks to this, it has no problem to attack my site even if the token expires.

Recently, I switched to Burp Suite thanks to the trial version to do some comparative tests. However, I can't reproduce this mechanism so that it authenticates itself during the automatic scan. Could someone advise me? I found some pages that seem to describe this mechanism but my requests are not the same and I'm a bit in trouble (For example, I can't find a deauthentication request).

Thank you in advance for your advice! I hope this time I've been clear enough ;) (yes this is my second post after the last one was blocked)

What I found :

• https://portswigger.net/support/configuring-burp-suites-session-handling-rules

Answer 1

I also faced the same issue with Angular (OAuth) multi page login has the login issues with one of the web app I was testing so I came up with a burp multi extension solution. If you are interested, you can try the following, which optionally use the selenium webdriver to perform the login using chrome headless browser. This way, you can perform the multipage login. I have covered detailed steps also.

Burp Extension: https://github.com/V9Y1nf0S3C/BurpExtension-JWT-4-session-handling

Blog for detailed walkthrough: https://vinay-infosec.medium.com/session-handling-with-jwt-in-burp-suite-part-1-1f28efb92dda

I wrote this in 4 blogs with the use of individual plugins. Hope it helps.

Answer 2

Recently portswigger has added in the functionality to record the authentication process within burpsuite. Burpsuite will then be able to authenticate if its current session expires or it becomes unauthenticated. This functionality is available in version 2020.9.2 and onwards.

Source: https://portswigger.net/burp/documentation/desktop/scanning/recorded-logins

Is this the functionality you are searching for?