Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

Copy as curl command in Burp Repeater doesnt include --compressed flag even if the request has Accept-Encoding: gzip, deflate

Benny | Last updated: Feb 02, 2023 06:35AM UTC

Hi Version: Burp Suite Professional v2022.12.25 Please note the "Copy as curl command" in Burp Repeater doesn't include --compressed flag even if the request has Accept-Encoding: gzip, deflate. The issue is that while executing the curl command on the shell, the server returns a response that contains a compressed response that matches one of the encoding that it supports. (e.g content-encoding: gzip). But as the --compressed option is not specified curl is being told to store the exact stream (compressed or not). (https://github.com/curl/curl/issues/2836#issuecomment-410604612) Hence curl doesn't return any body but rather it returns an error 23 "Failed writing body". Could you please help to understand if there's something I may have inadvertently overlooked or is this a missing option? Thank you Kind Regards Benny Jacob

Hannah, PortSwigger Agent | Last updated: Feb 02, 2023 09:14AM UTC

Hi If you go to your "Repeater" menu bar (inline with "Burp", "Project", "Intruder", etc) and uncheck the "Unpack gzip/deflate" option, does that change the curl command generated?

Benny | Last updated: Feb 06, 2023 06:09AM UTC

Hi Thank you for the suggestion. Please note the generated Curl is not changed despite leaving the option "Unpack gzip/deflate" as Unchecked. However the response body is not uncompressed and as expected the repeater tab shows gibberish. Kind Regards Benny Jacob

Hannah, PortSwigger Agent | Last updated: Feb 08, 2023 03:47PM UTC

Hi Benny Thanks for that information. We'll discuss further internally whether we should be adding the "--compressed" flag where appropriate. In the meantime, manually adding the flag should resolve your issue, as you've already discovered.

You need to Log in to post a reply. Or register here, for free.