Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Authenticated Audits with token in HTML5 localStorage

Ben | Last updated: Mar 30, 2022 07:52PM UTC

I am trying to run Burp Pro against a VueJS app that utilizes WebSockets and stores JWT/refresh tokens in the browser's localStorage. Is there a way to use the token so that Burp Pro can automatically scan and audit the authenticated side of the website? This is an example of the WebSocket packet that is sent to the server. {"clientId":"04883f2f-def1-443f-9ff6-3be978ea78d6","messageType":"request","type":"GET","uri":"devices?pageSize=100","header":{"authorization":"TOKEN_HERE"}}

Hannah, PortSwigger Agent | Last updated: Mar 31, 2022 01:46PM UTC

Hi Is your target application reliant on WebSockets to operate, or does it have a fallback mechanism that doesn't require the use of WebSockets?

Ben | Last updated: Apr 05, 2022 05:01PM UTC

The application only uses WebSockets

Hannah, PortSwigger Agent | Last updated: Apr 06, 2022 09:20AM UTC