Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Disabling URL Encoding in Spider

Vladamir | Last updated: Jul 12, 2019 01:17PM UTC

Hi, Intruder has a feature that allows the user to specify whether or not special characters should be URL-encoded. Is there a similar feature for custom values submitted with the spider?

Liam, PortSwigger Agent | Last updated: Jul 15, 2019 02:31PM UTC

There is no similar feature in Burp Spider. It's worth noting that we have replaced Burp Spider with Burp Crawler. Could you let us know your exact use case for this feature?

Burp User | Last updated: Jul 16, 2019 02:19PM UTC

I haven't upgraded to the newest version of Burp yet. I'll have to do that. But the reason I ask is because sometimes when I'm doing manually testing I want the spider to submit a bunch of special characters into all parameters. Then I can look for strange behavior, errors, and so on. When the request is a GET, the characters are double encoded; so if I tell Burp to submit this: '";>/<. The spider submits the following: %2527%2522%253b%253e%252f%253c This may cause the application to behave differently than if it submitted this: '%22;%3E%2f%3C Or at least that was my assumption. I'm not too experienced with webapp testing yet so maybe I'm just mistaken.

Liam, PortSwigger Agent | Last updated: Jul 16, 2019 03:00PM UTC