2

I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked.

enter image description here

I understood what is being us asked to do, but I don't understand why if I change it manually it doesn't work, whereas if I use the burp button "change request method" does, as it's the same text at the end, am I missing something?

This is the original request

And here after I modify it with the button

The only difference is that I write that GET string manually and then add the ?changeMe=Requests+are+tampered+easily I don't understand why it won't work and it's driving me nuts.

Oh and another thing, if I enter the x-request-intercepted:true below Cookie sometimes wont work, is it being considered body or what? (there isn't a break line)

1 Answer 1

3

I'm assuming you mean "use Burp's built-in functionality, such as Change request method", when you say "editing HTTP... with burp" (as opposed to "manually"), and that just changing the request text in the edit box is the "manually" you mean. If that's wrong, please clarify.

Burp does a number of things quietly and automatically, which you might not realize. Among them:

  • Updating the Content-Length header if you edit the body.
  • Removing Content-Length and Content-Type if you use its built-in feature to transform a POST request into GET, and vice-versa.
  • Decompressing and/or stitching together requests and responses that are sent compressed / chunked.

There are some things it does not do (by default), though:

  • Ensuring there are two newlines at the end of an edited request.
  • Ensuring newlines are in the expected \r\n form (which most servers are flexible on, but is actually in the spec), although I think it does use that form for pressing Enter/Return within the box regardless of OS.
  • Removing or modifying headers that don't make sense for a particular verb.
  • Reformatting the body when you manually change the Content-Type, or vice-versa (changing the header).
  • Ensuring your headers (or first line) are nicely formatted (or even just well-formed) and have sane values (your x-request-intercepted header is missing a space, and although I don't think that matters I could be misremembering or the server might expect it anyhow because it's typically there).

If you want to compare a request you hand-crafted vs. one that is machine-generated, you can try the Raw tab but the Hex tab is actually more informative; it won't hide things like newline style or other non-printing, whitespace, or similar-looking characters. You can also easily try many small iterations on a request in Burp by using the Repeater tab (most easily done by clicking Action or right-clicking in the request text area and choosing "Send to Repeater"). Repeater is tabbed, remembers history, and can show multiple variants of the same request in different tabs.

At the end of the day, HTTP is all just bytes, and that's what Burp sends. Whether the bytes were manually entered by a human user or added/changed by Burp's request/response modification features is irrelevant. You could also send the same bytes using netcat (nc, ncat, or netcat, depending what you have installed), or any other program that can interact with the network using TCP (and, in the case of HTTPS, TLS; you don't want to try doing the TLS handshake and cryptography manually).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .