Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

How to send http Option Request then fallow up with post Request after ?

dan | Last updated: Jan 18, 2022 01:22AM UTC

Hello i have 2 scenario's : 1. where i have to send http Request "option" for the server to allow me to send post request with §variable-A-number§. So i need to send first one request "option" as is no edits, the in short period send Post Request. 2. same thing as above just need to send Get request and if the word "green to go found in the result of the sent get request " then send post request with §variable-B-number§ Please help with this couldn't figure it out from online googling

Liam, PortSwigger Agent | Last updated: Jan 18, 2022 09:16AM UTC

Do you want to perform this function manually, or do you need this to be automated?

Edwin | Last updated: Nov 14, 2023 06:00PM UTC

Hi Liam or any friend at Support team, I'm facing the exactly Sam's situation. In my case, I want to do this automatically. I mean, this could be done via Intruder tool? Or maybe a Macro and how to do it? Thank you in advance! Edwin.

Dominyque, PortSwigger Agent | Last updated: Nov 15, 2023 09:22AM UTC

Hi Edwin Can you please expand on exactly what you are wanting to do? So that we can best advise you.

Edwin | Last updated: Nov 15, 2023 09:34PM UTC

Hi Dominyque When I click on "Recover Password" in Burp Proxy an HTTP OPTION request is sent first, then after sending and receiving that request the HTTP POST request is sent to the intended endpoint so, in order to automate an attack using Burp Intruder, how can I send a POST request to Burp Intruder knowing that it must be preceding a HTTP OPTION request?

Dominyque, PortSwigger Agent | Last updated: Nov 16, 2023 09:04AM UTC

Hi Edwin Thank you for providing further explanation. You should be able to do this using a macro. If you run a macro, select the request that you want and hit OK (ensure that Intruder is selected in the Scope settings, but this should be enabled by default) Then, set up your intruder attack as you normally would, but you must set a Resource Pool and have the maximum concurrent requests = 1. The macro will run first- sending the request, and then the first Intruder payload should be sent. Please let me know if this works for you.

Edwin | Last updated: Nov 16, 2023 08:50PM UTC

Hi Dominyque, Thank you so much. I will try your instructions and if in any doubt in the process, I appreciate your kindly support. Regards.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.