Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Allow extensions to modify proxy history

Tom | Last updated: Sep 01, 2017 02:59PM UTC

I was attempting to create an extension that would offer an option to automatically censor passwords or particular secrets within the Proxy HTTP History. Unfortunately, this does not appear to be possible, because the Burp API does not allow modifications to the history: an UnsupportedOperationException is thrown with the message "Proxy history is read-only" when I try to call IHttpResponse.setRequest. Is it really necessary to prohibit extensions to make changes to requests/responses within the history? If not, could this be allowed in a future release?

PortSwigger Agent | Last updated: Sep 04, 2017 09:01AM UTC

Hi Tom, Thanks for your inquiry. We've discussed this internally. We feel that the proxy should be a historical record of communication, which means it's immutable. Also, Burp projects are likely to contain lots of confidential data, so even with a password scrubber, the files would still need to be treated sensitively. So I'm afraid we won't be making the history mutable at this point. Please let us know if you need any further assistance.

Burp User | Last updated: Sep 05, 2017 03:01PM UTC