At my workplace we are implementing a process so my colleagues can share the burp states of the security assessment of the project.

The issue here is, sometimes we have to use personal account information to check productions issues.

My question is about is there any option provided in burpsuite tool that I can use it to remove such sensitive data in logs before sharing it with anyone?

  • you don't use test accounts? – schroeder Nov 4 '19 at 10:49
  • What can be saved or not saved in a Burp project is more of a question for Portswigger support. – schroeder Nov 4 '19 at 10:52

Not without a lot of manual effort.

But the fact that you have to use personal accounts is the actual problem. Whenever you test an application, demand a dedicated test account (preferably one per role). That way, the burp state can be shared without any problems.

If you absolutely have to use personal accounts for some horrible reason, you will have to remove every mention of your passphrase from the burp state before sharing it. This may be tedious, depending on how the application works. If it's HTTP Basic Auth, which shares the plaintext credentials every time, you may as well not share the burp state at all and just copy individual requests.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.