Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

how to configure the session management

hong | Last updated: Jan 20, 2017 03:43PM UTC

Hi, Regarding session management, I would like to confirm followings: (1) is it possible to configure login macro to do following: To login, I need to issue three different commands, assume a, b, c command a will get back cookie_a. command b will use the cookie_a, and get back cookie_b. command c will use both cookie_a and cookie_b, and get back 3 more cookies cookie_c1, cookie_c2, cookie_c3. Then the rest of request will need to use these cookie_c1, cookie_c2, cookie_c3 to get access to the host. (2) Is it possible to select some cookies (not all) in cookie jar to the request? Thanks

PortSwigger Agent | Last updated: Jan 20, 2017 04:27PM UTC

You can't configure a macro to only use specific cookies at a given step. You can just configure the macro step to either use cookies from Burp's cookie jar or not. But this is the normal behavior of browsers when issuing requests after multiple cookies have been set by previous responses. Are you seeing a situation where the application only works if some of the issued cookies are not later sent? And if so, what is the reason that a normal browser is able to work with the application?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.