Questions tagged [burp-suite]
Burp Suite is a popular platform for performing security testing of web applications. It can also be used by a malicious party to analyze and attack web applications. Implemented in Java.
257
questions
0
votes
0
answers
15
views
How to combine multiple HTTP requests into one on burp suite?
How do I combine multiple HTTP requests into one on burp suite? I am trying to do this in Burp Intruder in a way that each request is detected as a separate request but I send it all in one request ...
- 261
0
votes
1
answer
112
views
How long would this take to bruteforce?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Having inspected the source code ...
- 705
0
votes
0
answers
41
views
Does Burp Suite affect my request directly?
When I try to bypass the security configuration of Natas13 (http://natas13.natas.labs.overthewire.org/ A/P:natas13/lW3jYRI02ZKDBb8VtQBU1f6eDRo6WEj9) while using Burp Suite Community Edition on ...
1
vote
0
answers
41
views
How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?
I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks.
For instance if the server ...
- 141
1
vote
0
answers
112
views
How to reproduce following POC of dom based open redirection Vulnerability Flagged by burp suite scan
During scan, the burp suite flagged DOM open redirection vulnerability with the following POC. How can I reproduce it?
Data is read from document.referrer and passed to xhr.send.
The following value ...
- 11
1
vote
0
answers
163
views
Changing referer value in burp request has no impact on the response
I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response.
The Referer contains the URL along with the unique ID of ...
- 23
0
votes
0
answers
270
views
CVE 2022-21661 - WP Injection replication
I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan.
I'm trying to submit a POST request ...
- 1
0
votes
1
answer
153
views
Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string
I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
- 101
1
vote
1
answer
169
views
Reflected DOM XSS Portswigger Lab
I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere.
Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
- 13
0
votes
1
answer
217
views
How does Burp Collaborator payload reach the targeted vulnerable site?
I want to inject the collaborator payload in the HTTP Host header (HTTP Host header injection).
GET / HTTP/1.1
Host: payload.collaborator.net
The Host header is used to reach the targeted webserver ...
- 41
0
votes
0
answers
222
views
How to intercept traffic between two Docker containers
I'm trying to test a man-in-the-middle attack between two Docker containers.
The local virtual machine has two containers with the same bridging network, I 'm trying to use burpsuite to intercept ...
- 1
-1
votes
2
answers
71
views
HSTS Policy Not Appear in Burp Intercept Response
We have added HSTS policy at Akamai level (domain). When we Intercept the request using burp we dont see HSTS policy is getting added in response, in case we hit site with http.
But with https we able ...
- 99
0
votes
1
answer
69
views
How does this PortSwigger lab's XSS work?
I was doing the following PortSwigger Lab on cross site scripting (XSS).
The following payload works perfectly.
http://foo?'-alert(1)-'
Which is input into the following section of ...
- 181
0
votes
1
answer
197
views
portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked
I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked".
I successfully fire the print() on myself and the simulated victim, ...
- 1
0
votes
1
answer
450
views
XSS against jQuery PortSwigger challenge
I am trying to do this jQuery XSS challenge here by PortSwigger.
They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
- 181
0
votes
2
answers
47
views
Altering requests after authenticating
In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
- 2,141
0
votes
0
answers
83
views
cmd.jsp - Tomcat - Understanding HTTP Status Code (302)
I'm currently playing with cmd.jsp webshells on a Java webapp in tomcat.
This is the request (sending via burpsuite)
PUT /path/cmd.jsp HTTP/1.1
Host: 69.69.69.69
Content-Length: 579
<%@ page ...
0
votes
1
answer
49
views
Modifying request responses leading to unauthorized access?
I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
- 105
0
votes
1
answer
376
views
Burp suite: URL encoding of request body - Is this safe?
Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
- 7
0
votes
1
answer
300
views
Passing the session ID of an unauthenticated user to a valid session using Burp
I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension).
So ideally, the Autorize says the requests ...
- 7
0
votes
0
answers
22
views
Encrypted/Encoded text in the Burp HTTPS request - Android [duplicate]
I am analyzing the HTTPS traffic from a particular Android app using the Burp proxy. So every 5 minutes, the app hits an endpoint and sends an encrypted/encoded text in its HTTPS request. I tried ...
- 7
1
vote
0
answers
254
views
Invalid Target in Intruder
starting with Burp Suite and trying to breach DVWA, I am bugged with this error: "Invalid Target".
Damn Vulnerable Web App is actually hosted on the private net as Burp shows:
Where am I ...
- 193
-1
votes
1
answer
771
views
Credentials in a POST body over https are visible [duplicate]
Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. ...
- 1
0
votes
0
answers
110
views
How to perform php post request attack with javascript sanitization?
The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
- 9
0
votes
0
answers
716
views
How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?
I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
- 154
2
votes
2
answers
2k
views
How to send 2 or more requests at the same time using Burp Suite?
I want to test some application by sending 2 or more requests at the same time (at the same second or even millisecond) using Burp Suite.
By using Intruder or Repeater I can't do that at literally one ...
- 137
0
votes
1
answer
659
views
How to modify the response code of a website in burp? [closed]
Imagine website http://x.x.x.x//thing.php returns a response code of 302 instead of 200, meaning I get redirected to http://x.x.x.x//other.php instead of going to http://x.x.x.x//thing.php.
Can I use ...
- 1
0
votes
1
answer
1k
views
Intercepting app with Burp shows no requests
I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop.
But no ...
0
votes
1
answer
187
views
Capturing data from a Change Password form
Through ZAP, I was able to capture the following from a Change Password form:
GET /rest/user/change-password?current=P@ssword&new=password123
&repeat=password123 HTTP/1.1
Host: localhost:3000
...
- 49
0
votes
1
answer
284
views
How to fix Burp Suite broken encoding?
Currently, I'm learning IS and training on THM, so I use build-in VirtualBox (that might be important). I met this problem with broken coding in Burp Suite. How can I fix that? May be someone has ...
- 137
0
votes
0
answers
518
views
Burp Suite does not intercept packages from my Firefox
I configured Burp Suite in my virtual Kali Linux on VMware and activated FoxyProxy in Firefox (again in Kali/VMware). However it does not intercept anything, rather websites are blocked with the below ...
0
votes
1
answer
663
views
Man-in-the-Middle Mobile (e.g. Android) Application Tool
I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
- 1
1
vote
0
answers
254
views
Needing help intercepting local SSL traffic on a difficult Android app
I'm trying to intercept traffic from an Andriod app.
I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
- 11
0
votes
2
answers
1k
views
Burp - How to capture local traffic from Android device (i.e traffic that doesn't use the internet)
I'm trying to intercept traffic between an Andriod App and a Router interface. I'm using a rooted device.
They communicate on port 6699 which I believe is typical for nginx.
I've tried setting up Burp ...
- 11
0
votes
0
answers
536
views
How to redirect ettercap or arp poisoned traffic to burp suite or mitmproxy?
I have poisoned the target using Ettercap and redirected the traffic to my IP address. The question is, how to intercept and modify this traffic using burp suite or mitm proxy?
The only condition is, ...
0
votes
2
answers
650
views
how to load files in TLS PASS Through in Burp Suite?
I tried to load .txt files in TLS PASS Through but it is not accepting the file type. I tried with (.txt) and (.csv) .
The reason behind this is when I open a new project in Burp Suite all time it ...
1
vote
1
answer
125
views
urbanairship basic Authorization found in Mobile Application Outgoing Traffic
I was testing an android application using Burp suite. When I opened the android application, an app "Outgoing Traffic" log was added in Burp suite Site map. The API request is:
PUT /api/...
- 319
1
vote
1
answer
725
views
How to ignore request-response pairs with a 304 status code in Burp?
I'm using Burp Pro to assess a web application that sends a requests to an particular endpoint every second. This responds to almost every request with a 304 Not Modified status code, and I'd rather ...
- 141
2
votes
0
answers
331
views
What is the impact if there is Race Condition while submitting OTP?
I recently came across a web application where it was asking for an OTP after a successful login.
Let the endpoint be https://www.example.com/otpcode
The initial test for a brute-force of the OTP ...
- 189
1
vote
0
answers
102
views
call http-webpage in local browser, where the webserver is only reachable through proxychains (as it sits in a different network)
I have the following proxychains.conf
[...]
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
#socks4 127.0.0.1 9050
# <ip_prox_1>
http 10.10.10.100 3128
# ...
- 111
1
vote
0
answers
122
views
Is there any way to fuzz a HTTP response field via Burp Intruder?
I found a privilege escalation bug in an HTTP response page and I want to fuzz one of the field with ID values that define the admin role and see if any other viable ID comes up. Is there a way to do ...
- 11
0
votes
1
answer
178
views
why the website cant understand my request in http smuggling?
hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website.
i send
GET / HTTP/1.1
Transfer-Encoding: chunked
Host: subdomain.domain.com
User-Agent: Mozilla/...
- 73
0
votes
0
answers
383
views
unable to pass recaptcha test using burpsuite proxy
when I open the burpsuite proxy, it kept hit me with recaptcha , after I click submit, another one pop up, and another, and another, and so on what is wrong?
0
votes
1
answer
652
views
How to use custom HTTP headers with nmap?
I am trying a bbp program, and they allow requests only with some custom headers. So I was wondering if it is possible to add custom headers to nmap requests.
Things I tried:
I tried using burp proxy. ...
- 217
0
votes
2
answers
350
views
I found that I could delete the state parameter in an OAuth request and the response was validated and e-mail was still verified
I was fiddling around with an OAuth2.0 request on burpsuite and I found that it validated the account even after I deleted the state parameter completely and forwarded the request through burpsuite. I ...
1
vote
0
answers
248
views
Decoding burp XSS DNS resolution payload
I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
- 11
2
votes
1
answer
415
views
Error in intercepting the request of an Android application
I'm trying to analyze my flutter app's network traffic so I used burp suite for intercepting. First, I'm using the proxy option of burpsuite. I set my PC's IP address and port as 8080. Also in my ...
- 121
0
votes
1
answer
282
views
Any there any tools like Burpsuite that fully support HTTP/2? [closed]
Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that ...
- 48
0
votes
1
answer
562
views
Burp Suite upstream proxy
Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
- 187
0
votes
2
answers
693
views
How does Burpsuite sitemap (find) this PHP file from a PortSwigger lab?
I am doing the PortSwigger labs and came across this one: https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-arbitrary-object-injection-in-php
The first step of the ...
- 383