4

While scanning an application through Burp, I've found that if I use multiple threads, it results to session errors like The requested session id appears to be invalid. You may have more than one Task Manager window/tab open.

But if I use single thread, the scanning is slow.

Can anyone explain me how to assign different session IDs to different threads so that I can scan through multiple threads? Is it possible to use multiple threads with multiple distributed cookies to these threads using Cookie Jars?

Improve this question
2
  • That's actually quite interesting. Have you considered running multiple instances of Burp?
    – Lucas Kauffman
    Jan 6, 2015 at 10:10
  • Lucas, running two burp application will slow down my machine and it will not serve my purpose of having a fast scan then I will have two slow scanning running simultaneously on a slow machine
    – siddhu619
    Jan 9, 2015 at 15:22

1 Answer 1

Reset to default
3

This is ultimate answer by none other than Dafydd Stuttard when I posted this question on portswigger support forum:

Dafydd Stuttard Jan 12, 2015 10:58AM UTC Support Center agent

It sounds like the application is not willing to support multiple concurrent requests in the same session (for this particular function, at least).

Burp only currently has a single cookie jar, so you can’t do a scan with multiple threads using different cookie jars, sorry.

One possible solution would be to create an extension that handles sessions, and maintain your own separate cookie jars and use one per thread. Or you could run multiple instance of Burp, each running single threaded, and scan different parts of the application with each one.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .