Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Help with updating a parameter in Ruby

Denis | Last updated: Dec 15, 2020 06:42PM UTC

We've been using a script to update request headers (e.g., JWT) that we found here: https://raesene.github.io/blog/2016/06/19/Burp-Plugin-JWT-Tokens/ We've had use cases where we need to sign in, capture a CSRF token in a response and use it in subsequent POST requests. I've been having a difficult time with finding burp ruby documentation and examples, but I was hoping someone can help. I only need a snippet of code that will update the csrf post parameter from: macro_response_info = @helpers.analyzeResponse(macroItems[1].getResponse()) I tried using these but don't know what goes into the 3rd argument for buildParameter(). csrf_build_param = @helpers.buildParameter("csrf", "TEST", ) csrf_update_param = @helpers.updateParameter(baseRequestResponse, csrf_build_param) Relevant code: request_info = @helpers.analyzeRequest(baseRequestResponse) macro_response_info = @helpers.analyzeResponse(macroItems[1].getResponse()) #grab cookie value from last request in response macro cookies_array = macro_response_info.getCookies() xsrf_cookie = cookies_array[1] xsrf_cookie_value = xsrf_cookie.getValue() [Need code to update csrf POST parameter for the request with xsrf_cookie_value] Can anyone please assist. The documentation for ruby is difficult to understand.

Hannah, PortSwigger Agent | Last updated: Dec 16, 2020 09:25AM UTC

Hello The documentation for IExtensionHelpers.buildParamter() is as follows: IParameter buildParameter(java.lang.String name, java.lang.String value, byte type) This method constructs an IParameter object based on the details provided. Parameters: name - The parameter name. value - The parameter value. type - The parameter type, as defined in the IParameter interface. Returns: An IParameter object based on the details provided. The different types in the IParameter interface are as follows: PARAM_BODY, PARAM_COOKIE, PARAM_JSON, PARAM_MULTIPART_ATTR, PARAM_URL, PARAM_XML, PARAM_XML_ATTR You can find the extension API documented here: https://portswigger.net/burp/extender/api/

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.