Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Define custom login / logged off states for crawling

Peleus | Last updated: Jun 25, 2020 01:06AM UTC

Prior to the Burp UI revamp you could configure crawling to utilise a custom login macro for crawling. Now, crawl configuration only has a single login configuration - where you supply a username and password - and Burp attempts to figure out the rest. The application being tested has three parameters required for login - Organisation, Username, Password. It appears that Burp cannot handle this scenario. Is there a way we can utilise the old Burp style configuration to define a custom login path I can saw "When you get this session you are authenticated"? Is there a way I can define a logoff state where I say "If you're seeing this page you've logged out?"

Uthman, PortSwigger Agent | Last updated: Jun 25, 2020 11:08AM UTC

Hi Ryan, How were you achieving this in a previous version of Burp? What version are you referring to? Is your intention to make the scanner use a macro to log in to your application? You can record a macro under Project options > Sessions > Session Handling Rules. Just set the Scope to the Scanner. You may be able to achieve your desired outcome using the 'Check session is valid' rule to define both a valid and invalid session.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.