Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Allow Extensions to Bypass Global Timeout

Y-Security | Last updated: Dec 29, 2021 03:53PM UTC

Hi, we're testing a system that does not send a response on successful exploitation. In ActiveScan the Status changes to "Errors: request timeout" and the vulnerability isn't reported. When using a modified activeScan++ Extension I can catch the see that the issue is tracked up until class CustomScanIssue(IScanIssue) --> _init__( However, the issue does not adds into "Issue Activity" overview. It can be reproduced with the latest activeScan++ Extension when scanning against the vuln Log4j PoC from here: https://github.com/leonjza/log4jpwn Result: no Log4Shell issue is reported Expected result: Log4Shell issue is reported Feature request: Make the Request interface available independently from the Response / Allow to drop responses after an extension defined timeout. Maybe bug report: it feels like the issue should be flagged even if there is an timeout (the issue has been confirmed, it fails to add it)

Alex, PortSwigger Agent | Last updated: Jan 04, 2022 04:34PM UTC

Hi, Thanks for your post. I've passed this onto the dev team for review, I shall update you accordingly. Thanks

Alex, PortSwigger Agent | Last updated: Jan 07, 2022 11:39AM UTC