I would like to get your thoughts/inputs on what approach one can adopt in order to perform penetration testing on a web application which has unique strings appended in every HTTP request. Every response from the server comes with a unique token that is then added (by the client side script) to every request that is made from that page. This means that repeating or fuzzing with burp suite is not an option as the application throws users out with repetitive requests or invalid strings.

  • 1
    Is the URL constant for any given page, or does it change at every request? – Anders Oct 25 '17 at 7:41
  • @Anders It does change at every request. Every request gets a response from server with another unique string which then gets appended to following http requests by clientside script while redirecting or page submits. – iSRC Oct 26 '17 at 5:21

Burp supports Macros and Session Handling Rules that are designed to cope with this kind of situation. For example, you can configure a macro that fetches a fresh token, and a rule that updates the current request. This can be used with all Burp tools, including Intruder and Scanner. There's some more information here.

The built-in rules cannot update tokens in the URL. However, the Custom Parameter Handler extension lets you do that.

It can be a little bit fiddly to set this up, but it is possible to configure working session rules for most sites. You also have the option of coding your own extension.

Affiliation: Burp Suite is a commercial product of ours.

  • While on-topic and answering the question, please do disclose your affiliation when recommending a commercial product of yours. I've edited the post to include this in an unobtrusive manner. – Luc Mar 5 '18 at 7:45
  • 1
    @Luc - I think the affiliation is obvious from the user name, and considering Burp was named in the question it is a stretch to call this a recommendation. I'm going to leave your edit for now. However, please create a meta post before making any further similar edits. – PortSwigger Mar 5 '18 at 8:42
  • 2
    Oh darn, I must have mixed up two questions because I remember checking and I found no burp tag in the question. Must have been a different one. Sorry, my mistake. I still think a small note is not bad, but I see your point. – Luc Mar 5 '18 at 10:23
  • 1
    Hey @PortSwigger, while it is great that you are here to answer questions regarding Burp, please note that the topic of product support is already covered in the Help center section, specifically here and here. To quote: "However, you must disclose your affiliation in your answers." We welcome your effort here, and while it might be obvious for the experienced user that Burp Suite is a product of PortSwigger, it might not be for newer ones. – Tom K. Mar 5 '18 at 10:31
  • 2
    @TomK. your concern has been raised in Meta – schroeder Mar 5 '18 at 12:23

My approach to this

Write a quick application to ‘index’ the site, using your preferred development language, and export that to a csv file and then import that into your fuzzer as a set of urls to test.

If you don’t have any development skills then you need to find a third party tool or developer to help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.