Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

BCheck Multiple Request for Run For Each definitions

DL | Last updated: Jun 11, 2024 02:36PM UTC

BCheck has this "run for each" definition which will send a request for each instance of the variable. How can I display in the advisory all the requests and responses? So far, I am only seeing one request and one response

Hannah, PortSwigger Agent | Last updated: Jun 12, 2024 09:56AM UTC

In this case, it sounds like writing an extension for your scan check would be more appropriate, as it would allow you to attach multiple request/response pairs to the raised issue. You can find an example extension for writing scan checks here: https://github.com/PortSwigger/burp-extensions-montoya-api-examples/tree/main/customscanchecks To help us better understand your use case, could you give us a bit more information around what test you are trying to perform and why you would like all requests and responses displayed in the issue? We may be able to raise a feature request to track this functionality for future iterations.

DL | Last updated: Jun 12, 2024 02:36PM UTC

I am trying to run a bcheck to test for authentication & authorization. But it seems like I will only be able to do this one bcheck by one bcheck or using the custom scan check extension for now T_T ``` run for each: token = "token","token2","token3" given request then: // token replacing bcheck request function ```

Hannah, PortSwigger Agent | Last updated: Jun 12, 2024 04:03PM UTC

Hi When reporting, are you using "report issue and continue"? This allows the BCheck to continue to run after having found an issue previously, which means you will iterate through all token values rather than testing one, finding an issue and stopping.

DL | Last updated: Jun 12, 2024 05:15PM UTC

sounds like a good workaround, but will still prefer multiple request / response displayed so that I can see what the requeset/responses flagged are and confirm the issue.

Hannah, PortSwigger Agent | Last updated: Jun 13, 2024 04:46PM UTC

Thanks for that information - in this case, it seems like an extension would be better suited for your use case. These need to be written in Java to use our Montoya API. However, our old Extender API is compatible with Python 2.7 if you're more comfortable with Python. You can find out more about writing extensions here: https://portswigger.net/burp/documentation/desktop/extensions/creating Please let us know how you get on!

DL | Last updated: Jun 17, 2024 08:37AM UTC

I managed to display multiple request by defining a different scan variable (check, check2). Would be more efficient if this can be done with "run for each" [...other definitions above...] given request then send request called check: replacing headers: "Authorization": `Bearer {token1}` if {check.response.status_code} is "200" then report issue and continue: [...] end if send request called check2: replacing headers: "Authorization": `Bearer {token2}` if {check2.response.status_code} is "200" then report issue and continue: [...] end if

Hannah, PortSwigger Agent | Last updated: Jun 17, 2024 01:51PM UTC

Thanks for the feedback. We have a feature request to support tuples in BChecks, which sounds like it would fit your use case. We've added your +1 to this ongoing feature request. Please note that we are still in the process of monitoring this feature request, and it is not planned in any of our short term work. If there's anything else we can help with, then please let us know.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.