Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

False Positive based on Last-Modified header

Syed | Last updated: Jun 14, 2024 05:54AM UTC

Hi, Burp Scanning does check for "Date" header and its modification, even though its modified in response, it wouldn't call that a "Response Modification". However, the header "Last-Modified" is not whitelisted and actually when it modifies because of the time, whatever payload/attack burp is doing, it reports it as valid because of this. Even though it is a false positive. The "Content-Length" header too remains the same! One such example I came across is "LDAP Injection", based on "Last-Modified" header, burp declares this as a valid issue even though it is false positive. If the "Last-Modified" header can be excluded too, that would really save a lot of FPs and manual validation. POCs: Burp Reporting LDAP Injection: https://i.imgur.com/txqyRqd.png Response 1 (one highlighted item: Last-Modified header): https://i.imgur.com/XWak3Iw.png Response 2 (one highlighted item: Last-Modified header): https://i.imgur.com/1Wr4lxE.png

Hannah, PortSwigger Agent | Last updated: Jun 14, 2024 03:20PM UTC