Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How do I manually reproduce ruby code injection in cookie parameters?

Jason | Last updated: Nov 17, 2015 03:45PM UTC

One of the apps I'm testing is coming up with Ruby Code Injection alert. The confidence is listed as Firm. Issue Details: The payload '+sleep(20.to_i)+' was submitted in the foo parameter within the bar cookie. The application took 22015 milliseconds to respond to the request, compared with 15 milliseconds for the original request, indicating that the injected Ruby code caused a time delay. I've tried testing this manually by editing the cookie and refreshing the page but it always loads immediately. I've tried using TamperData to confirm that the cookie is being sent with the payload and it appears to be. I've also tried clearing the cache (minus cookies) and also html encoding the payload to no avail. Am I doing something wrong? Any ideas would be appreciated!

PortSwigger Agent | Last updated: Nov 18, 2015 08:50AM UTC