Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp v2.0.04beta - noscript redirect

Andrej | Last updated: Sep 05, 2018 03:08PM UTC

On the root \ (and all other) HTTP responses I have following code: <noscript><meta http-equiv="REFRESH" content="0; URL=/no-javascript"></noscript> With Burp 1.x it was sufficient to disable Project -> Meta refresh tag. However, it seems it may not be taken into an account with new crawler. What I now observe on site having few hundred pages, only the / and /no-javascript are crawled + audited. This leads me to believe that browser internally always try to follow the redirect, and ignores everything else. Is it possible to alter the behavior, so that such no-script redirect would not be followed? Otherwise, I need to route traffic through 2nd Burp proxy, just to remove this from HTTP response... Thanks

PortSwigger Agent | Last updated: Sep 05, 2018 03:23PM UTC

Hi Andrej, At the moment the crawler will indeed follow the noscript redirect. We are aware of this behaviour and are currently working on improving the way we handle redirects. In the meantime you can exclude these URLs from scope or use an upstream proxy as you rightly suggest. Thanks for the feedback!

Liam, PortSwigger Agent | Last updated: Sep 06, 2018 10:45AM UTC

Just to let you know, this bug is fixed in the latest version (v2.0.20beta). Thanks for your patience.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.