4

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here.

The situation is:

I have a web page, lets say: http://www.example.com/forum/register.php.

Amongst the other fields on the REGISTRATION form on this page, there is an emailID text field. Due to some weird logic of the application, and I do not really care what, as and when I type out characters in this text filed it pulls up a drop down box with all the matching suggestions for that character.

Example : Say I type in the character 'a', then some of the suggestions that get pulled up are like [email protected], [email protected], [email protected] etc.

Note: This is not an autocomplete enabled field/form that is leading to these suggestions being pulled up, just in case you were wondering on those lines.

I checked the request in BURP and there is an ajax request being made, as suspected, for each character typed in the emailID text field.

So from BURP the request is of the form:

GET /abcd/register.php?mod=ajax&inajax=yes&infloat=register&ajaxmenu=1&action=email_verify&email=allTheCharactersIEntered HTTP/1.1

Host: www.example.com

Now although INTERCEPT is ON in BURP and I can see that the above GET Request is paused (intercepted) for me to modify and forward the request, actually the response has already been received and the suggestion box has already been populated with the respective suggestions as I can see that in the browser and also in the HTTP History tab in BURP.

What I want to achieve is that: every time I type in a single character in the emailID text box (that's when the ajax call is being made, from my understanding), before the response (the suggestion drop down box) is generated I should be able to intercept and make changes to the typed in character on the fly.

What is it that I am missing here? How do I achieve the above? Please feel free to ask something that does not make sense in the above scenario.

Improve this question

4 Answers 4

Reset to default
1

Are you intercepting all requests or just "in scope" requests? Could it be that the logic in the JavaScript code tries another domain if it does not get a timely response - one you are not intercepting.

Another possibility is that there's a client-side cache of responses that is accessed if a timeout elapses. Maybe Burp Intercept is causing the timeout so the application simply accesses its local storage.

Have a look at the application's client scripts to find out exactly how this works. Also examine the full proxy logs in Burp to check you are not missing any requests.

Improve this answer
0

What you want to do is the proxy's job, Burp Proxy in your case. I would like you to make sure that you're not just viewing the traffic.

In case you're sure that the request is paused by Burp until you submit it. Then, i believe that the ajax call have a small timeout.

Improve this answer
2
  • I am quite certain that the request is paused. However, what i fail to understand is that despite the request being paused for interception, how is it that the response is already generated and rendered in the browser !
    – qre0ct
    Jan 29, 2015 at 6:00
  • If the ajax request has a timeout (for instance: 5secondes), the website will not wait more than 5secs for the response. Instead, it will execute another javascript code which is in your case providing other suggestions without the need of the response.
    – mzz
    Jan 29, 2015 at 14:50
0

May be this particular functionality (ajax GET request for each typed character) is some kind of legacy code, or simply forgotten old piece? May be application became upgraded and handle this "autocompletion" with some other means yet to be discovered, and this one request has no particular meaning, or just redundant (i.e. you block it and newer code kicks in doing its job)?

Improve this answer
2
  • I would beg to disagree. If I understand correctly what you are trying to say, there is NO autocomplete happening here in anyway.
    – qre0ct
    Jan 29, 2015 at 6:49
  • I could use the wrong word, but the context speaks for itself, anyway. The main point is that there is some other code on page, doing the same job in case this request is intercepted. Some legacy code, or, may be, some new functionality (and the code you have found to the moment is now obsolete, but forgotten here by developers - you block request generated by it, and newer functionality kicks in, using some other method to get the same info)
    – tis
    Jan 29, 2015 at 6:55
0

There are settings in Burp for not intercepting certain file types (like .jpeg, .css). I bet if you looked in the option tab of the proxy tool, you have .js as one of the skipped file types. If the page is requesting the results from a .js file, this would not be intercepted. In this image you can see the options for not intercepting certain extensions: https://www.pentestgeek.com/wp-content/uploads/2014/07/3-proxy-intercept-settings.png

Also, check out this question: Burp Suite is not intercepting JSON responses

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .