Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Advanced Scope Control does not follow correct regex syntax

iustin | Last updated: Jan 04, 2021 12:05AM UTC

Hi, I noticed the advanced scope control mentions you can insert regex, but it does not actually follow correct regex syntax. Asterisk `*`, should be treated as a quantifier, matching zero to unlimited times, however Burp seems to treat it as a wildcard. This behaviour will cause the following valid regex pattern to fail: `[a-z]*\.portswigger\.net` Should match subdomains only containing letters, however burp simply matches all subdomains. You can confirm what the correct output would be by visiting this link: https://regex101.com/r/cO8lqs/24847 I found this when I noticed the following invalid regex syntax was actually matching all subdomains: `^*\.portswigger\.net` This isn't valid regex, since it basically matches ^ (start of line), zero to unlimited times. Which does not really make sense. However, Burp treats it as a wildcard and matches all subdomains. You can confirm how this is invalid regex by visiting this link: https://regex101.com/r/lf2FkU/1 Personally, this does not affect me, since I never had to use advanced regex with Burp, such as the first pattern I showed. I thought, I'd let you know anyways in order to see if this is intended behaviour or not.

Hannah, PortSwigger Agent | Last updated: Jan 14, 2021 02:56PM UTC