Questions tagged [burp-suite]

Burp Suite is a popular platform for performing security testing of web applications. It can also be used by a malicious party to analyze and attack web applications. Implemented in Java.

Filter by
Sorted by
Tagged with
0 votes
1 answer
32 views

Portswigger SSRF basic lab question

I am working on some portswigger labs to get good at web security. I was doing this lab at the following link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost Spoiler, you ...
PurpleHacker's user avatar
0 votes
2 answers
84 views

How to Capture Mobile API Requests in burp when Server side pinning is implemented

I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
Tejas Pandya's user avatar
0 votes
0 answers
31 views

Using Burp Bambdas to filter proxy logs based on unmodified requests

A typical usage pattern for me in application testing is that I will write python scripts to automate various attacks against endpoints &c. What I want to do is add a header each request of the ...
Elliot's user avatar
  • 141
1 vote
1 answer
219 views

Unknown host on Burp Suite when trying to access *.localhost

I am trying to analyze HTTP traffic of our application. Application has two accessible portals, one accessible by admin.localhost:3002 and the other accessible by localhost:3002 I have Burp Suite ...
Gonzalo Aguado Torres's user avatar
0 votes
0 answers
104 views

Intercepting Android App: Google detects burp proxy and block the request to app

I was recently doing bug bounty on a website and found it also has an app so i tried to pentest on it using burpsuite via MITM and intercepting it through burp proxy Though my request got blocked by ...
Dang Max 2.0's user avatar
0 votes
1 answer
91 views

Issue uploading a file with cURL to WebSecurityAcademy Lab on PortSwigger.com

I want to solve an apprentice-level lab on PortSwigger.com focused on file upload vulnerabilities; the lab is called Remote code execution via web shell upload. The labs on PortSwigger.com encourage ...
Michael Sodeke's user avatar
1 vote
0 answers
59 views

How can I run Burp Scanner so that a request two requests are sent one after the other in that order?

I have to scan 2 API requests and for the second API request to be successful, the first API request must be successful and vice versa. Each time Burp Scanner sends a request, it should go in this ...
Testing's user avatar
  • 11
1 vote
0 answers
97 views

out-of-band data exfiltration Command Injection [closed]

A few days ago I found a vulnerability in a site of scope using the Burp suite scanner with the command nslookup xxx.burpcolaborator.com exploit with the following feature: Issue: OS command injection ...
Deviandorx's user avatar
1 vote
0 answers
78 views

What are the steps necessary to configure Burp Suite Crawler/Scan for maintaining login sessions?

I am running a Audit and Scan Deep Scan of a website using Burp Suite Professional v2023.10.3.7. I have entered the Settings for the scan and went to Application Login, entering credentials for the ...
the_endian's user avatar
  • 1,169
0 votes
1 answer
193 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
0 votes
1 answer
249 views

Setting up Burpsuite with a machine in another network

I'm currently testing a mobile app (suppose it communicates with the domain blablabla.net). For the purposes of testing this app, I've set up an android machine on another netowrk, and I'm currently ...
sag0li's user avatar
  • 3
0 votes
1 answer
146 views

Meaning of the custom http headers in burpsuite academy

I am going through the Burpsuite Academy Training on Serverside security and I came across a section I am not able to grasp fully: Some application frameworks support various non-standard HTTP headers ...
zero_day's user avatar
0 votes
1 answer
242 views

Can Burp detect new REST APIs exposed on a server

I am trying to write an automated test that runs on all exposed APIs on a server and checks each endpoint for vulnerabilities. The problem is the server I am testing always has new APIs exposed, so I ...
ethicalhacker's user avatar
0 votes
0 answers
486 views

HTTP request smuggling on NGINX gives error 400?

I'm learning about HTTP request smuggling and for this i'm trying to "break" into a broken site that is running under docker. The architecture of the site is Cache -> NGINX -> site. ...
Maria Ines Parnisari's user avatar
1 vote
1 answer
530 views

Burp DOM-based Open Redirect

When I sent a request such as: GET /500.aspx?aspxerrorpath=/error.aspx HTTP/1.1 Host: test.com Burp reports "The application may be vulnerable to DOM-based open redirection: Data is read from ...
TSFH's user avatar
  • 13
0 votes
0 answers
259 views

CVE-2021-22123 fortiweb bypass?

As a cybersecurity enthusiast, I tried to do the following exercise : A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
security enthusiast's user avatar
0 votes
1 answer
700 views

Staying anonymous while using BurpSuite

While testing any site using BurpSuite, if we send any request it will use BurpSuite HTTP "Proxying through BurpSuite" but still we are not fully anonymous, it will still use our original ...
Noob Hunter's user avatar
0 votes
1 answer
1k views

Not able to see server response when making request using python

Using the requests library, I am trying to make request to a url. I've set the target to the specific url and checked, "And URL Is in Target Scope" in both Request interception rules and ...
Karan Bakshi's user avatar
1 vote
2 answers
440 views

Reflected XSS detected by Burp Suite not working

Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or ...
Samuele Giovanetti's user avatar
0 votes
1 answer
650 views

How long would this take to bruteforce?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Having inspected the source code ...
user5623335's user avatar
0 votes
0 answers
142 views

Does Burp Suite affect my request directly?

When I try to bypass the security configuration of Natas13 (http://natas13.natas.labs.overthewire.org/ A/P:natas13/lW3jYRI02ZKDBb8VtQBU1f6eDRo6WEj9) while using Burp Suite Community Edition on ...
Iris Chen's user avatar
1 vote
0 answers
136 views

How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?

I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks. For instance if the server ...
Neo's user avatar
  • 141
1 vote
0 answers
357 views

How to reproduce following POC of dom based open redirection Vulnerability Flagged by burp suite scan

During scan, the burp suite flagged DOM open redirection vulnerability with the following POC. How can I reproduce it? Data is read from document.referrer and passed to xhr.send. The following value ...
Deathpoolxrs's user avatar
1 vote
0 answers
789 views

Changing referer value in burp request has no impact on the response

I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response. The Referer contains the URL along with the unique ID of ...
Supraja's user avatar
  • 23
0 votes
0 answers
607 views

CVE 2022-21661 - WP Injection replication

I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan. I'm trying to submit a POST request ...
Giacomo's user avatar
0 votes
1 answer
360 views

Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string

I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
razimbres's user avatar
  • 101
1 vote
1 answer
435 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
kgngkbyrk's user avatar
0 votes
1 answer
589 views

How does Burp Collaborator payload reach the targeted vulnerable site?

I want to inject the collaborator payload in the HTTP Host header (HTTP Host header injection). GET / HTTP/1.1 Host: payload.collaborator.net The Host header is used to reach the targeted webserver ...
Just.a.tech's user avatar
-1 votes
2 answers
197 views

HSTS Policy Not Appear in Burp Intercept Response

We have added HSTS policy at Akamai level (domain). When we Intercept the request using burp we dont see HSTS policy is getting added in response, in case we hit site with http. But with https we able ...
Vivek Dhiman's user avatar
0 votes
1 answer
222 views

How does this PortSwigger lab's XSS work?

I was doing the following PortSwigger Lab on cross site scripting (XSS). The following payload works perfectly. http://foo?'-alert(1)-' Which is input into the following section of ...
questioner's user avatar
0 votes
1 answer
465 views

portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked

I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked". I successfully fire the print() on myself and the simulated victim, ...
Juan's user avatar
  • 1
1 vote
2 answers
828 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
questioner's user avatar
0 votes
2 answers
86 views

Altering requests after authenticating

In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
microwth's user avatar
  • 2,473
0 votes
0 answers
200 views

cmd.jsp - Tomcat - Understanding HTTP Status Code (302)

I'm currently playing with cmd.jsp webshells on a Java webapp in tomcat. This is the request (sending via burpsuite) PUT /path/cmd.jsp HTTP/1.1 Host: 69.69.69.69 Content-Length: 579 <%@ page ...
citrusbytez's user avatar
0 votes
1 answer
287 views

Modifying request responses leading to unauthorized access?

I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
Muhaddis's user avatar
  • 105
0 votes
1 answer
903 views

Burp suite: URL encoding of request body - Is this safe?

Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
Supraja's user avatar
0 votes
1 answer
810 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
Supraja's user avatar
1 vote
0 answers
548 views

Invalid Target in Intruder

starting with Burp Suite and trying to breach DVWA, I am bugged with this error: "Invalid Target". Damn Vulnerable Web App is actually hosted on the private net as Burp shows: Where am I ...
Jishan's user avatar
  • 203
-1 votes
1 answer
2k views

Credentials in a POST body over https are visible [duplicate]

Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. ...
Rakoshin's user avatar
0 votes
0 answers
337 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
UkaChan's user avatar
0 votes
0 answers
1k views

How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?

I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
Virgula's user avatar
  • 154
3 votes
2 answers
5k views

How to send 2 or more requests at the same time using Burp Suite?

I want to test some application by sending 2 or more requests at the same time (at the same second or even millisecond) using Burp Suite. By using Intruder or Repeater I can't do that at literally one ...
dokichan's user avatar
  • 157
0 votes
1 answer
1k views

How to modify the response code of a website in burp? [closed]

Imagine website http://x.x.x.x//thing.php returns a response code of 302 instead of 200, meaning I get redirected to http://x.x.x.x//other.php instead of going to http://x.x.x.x//thing.php. Can I use ...
thething's user avatar
0 votes
1 answer
2k views

Intercepting app with Burp shows no requests

I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop. But no ...
Opera of the Phantom's user avatar
0 votes
1 answer
242 views

Capturing data from a Change Password form

Through ZAP, I was able to capture the following from a Change Password form: GET /rest/user/change-password?current=P@ssword&new=password123 &repeat=password123 HTTP/1.1 Host: localhost:3000 ...
t5j's user avatar
  • 49
0 votes
1 answer
552 views

How to fix Burp Suite broken encoding?

Currently, I'm learning IS and training on THM, so I use build-in VirtualBox (that might be important). I met this problem with broken coding in Burp Suite. How can I fix that? May be someone has ...
dokichan's user avatar
  • 157
0 votes
0 answers
789 views

Burp Suite does not intercept packages from my Firefox

I configured Burp Suite in my virtual Kali Linux on VMware and activated FoxyProxy in Firefox (again in Kali/VMware). However it does not intercept anything, rather websites are blocked with the below ...
Infomania72's user avatar
0 votes
1 answer
998 views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
Azulath's user avatar
1 vote
0 answers
396 views

Needing help intercepting local SSL traffic on a difficult Android app

I'm trying to intercept traffic from an Andriod app. I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
Doby's user avatar
  • 11
0 votes
2 answers
2k views

Burp - How to capture local traffic from Android device (i.e traffic that doesn't use the internet)

I'm trying to intercept traffic between an Andriod App and a Router interface. I'm using a rooted device. They communicate on port 6699 which I believe is typical for nginx. I've tried setting up Burp ...
Doby's user avatar
  • 11

1
2 3 4 5 6