Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Visual bug in Intruder when two payload sets are of type "Dates"

Nicolas | Last updated: Mar 04, 2015 06:30PM UTC

Tested on Burp Pro v1.6.11 on OpenJDK 1.7.0_75-b13 (and many different setups) That's an old bug, which happens only in a specific situation. How to reproduce: - send a request to Intruder - in the "Positions" tab, define two payload positions and select "Cluster bomb" as the attack type - switch to the "Payloads" tab - select payload set #1 - set the payload type to "Dates" - in "Payload options", set the "From" day field to 1 and the "To" one to 2 - select payload set #2 - set the payload type to "Dates" - in "Payload options", set the "From" day field to 3 and the "To" one to 4 - select back payload set #1 - BUG! The values from the "From" and "To" day fields are the ones from payload set #2 (resp. 3 and 4) Note 1: the fields are correctly updated when the mouse pointer leave the "Payloads" tab. Note 2: that's only a display bug. If the "Start attack" button is pressed, the correct values are used even if the wrong ones are displayed.

PortSwigger Agent | Last updated: Mar 05, 2015 02:41PM UTC

Thanks for this report. We'll try to reproduce this issue and let you know if we need any further details.

PortSwigger Agent | Last updated: Mar 10, 2015 02:53PM UTC

We've now reproduced this problem, and we'll get it fixed in the next minor update to Burp. Thanks for your feedback.

PortSwigger Agent | Last updated: Mar 12, 2015 03:56PM UTC

This issue should have been fixed in today's release, v1.6.12.

Burp User | Last updated: Mar 13, 2015 08:27PM UTC

I just tested v1.6.12. Thanks!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.