The application I'm running a security assessment on encodes POST requests as follows:

POST /foo/save HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 6652


i.e. A parameter containing JSON is inserted in the bar key, therefore it is JSON encoded and then percent encoded.

Is there a way to automatically encode payloads using Burp for use in Intruder? The only way that comes to mind is to run payloads through JavaScript hex encoding first, then load the encoded list into Burp and then URL-encode from there. Is there anything built in that would do this? The closest I found was "Javascript constructed string", however this is not suitable for use in JSON.

So to summarise I need the payload to be JSON hex entity encoded then URL encoded (Burp easily does the latter, so the JSON encoding is the bit I need).


There's no build in way to process your payload. Burb has the decoder tool but it's not linkable with other tools. You have three possibilities to achieve your processing:

  1. As you said: Generate your payload data with an appliaction and load the list into a custom iterator.

  2. Create an external application or script to generate your payload and use the runtime file payload. Sometimes this is a bit more useful if you have a big list of payloads or you need some other logic between the requests.

  3. Create or modify an extension to generate the payload. Have a look at this example.

  • Thanks - I had a dabble with creating an extension and it worked. I'm surprised it doesn't have anything built in to Burp as standard. I suppose you could use "Replace Regex" to change backslash to double and change " to \" for most applications. Apr 9 '15 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.