1

I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response.

The Referer contains the URL along with the unique ID of that particular user. Even if I change the ID to any value or change the entire Referer ID to some invalid value (For example, my name) the response is still 200.

However, when the Referer is removed altogether, the response says 400 bad request.

So I can even give any malicious URL there and still I will be getting a response? Does this say anything about the application or does it barely have any significance over security? Can this be exploited?

Improve this question
6
  • "Can this be exploited?" - To answer this one would need to know what the application does with the Referer apart from checking if it exists - which is unknown. If it purely checks for existence this can not be exploited.
    – Steffen Ullrich
    Oct 17, 2022 at 4:39
  • So if I change the referer value, response does not change from the actual one. So ideally it is just checking for the existence I suppose !
    – Supraja
    Oct 17, 2022 at 4:59
  • Also, how can I know what the application does with the Referer apart from checking if it exists?
    – Supraja
    Oct 17, 2022 at 4:59
  • 1
    "how can I know what the application does with the Referer" - if the application is a blackbox to you than you can only probe with different values, look at the result and make educated guesses - then probe more based on your educated guesses. If it is more than a blackbox (like common known application, framework, ...) you might look at the source code.
    – Steffen Ullrich
    Oct 17, 2022 at 5:05
  • 1
    If it is only about checking the referer then you get either a 200 (any referer) or 400 (no referer) but nothing bad happens in the application. There is no exploit there.
    – Steffen Ullrich
    Oct 18, 2022 at 18:57

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .