Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

how to update json parameters in request using Burp api?

Ali | Last updated: Mar 18, 2023 12:51AM UTC

Hi there, I am writing an extension which needs to update request parameters value with new injected payload. For GET/POST requests, headers and cookies it was quite straightforward. However, dealing with POST requests containing JSON data I could not find any easy way, or a method to use. Reviewing documentation here https://portswigger.net/burp/extender/api/burp/iextensionhelpers.html I see methods like addParameter, updateParameter, removeParameter don't support PARAM_JSON or PARAM_XML etc. Am i missing something or only getting JSON parameters and values is supported by Burp API but add/update/remove them are not supported?

Hannah, PortSwigger Agent | Last updated: Mar 22, 2023 01:37PM UTC

Hi It looks like you are using the legacy Extender API. Have you had a look at the new Montoya API instead? You can find more details on this here: https://portswigger.net/burp/documentation/desktop/extensions/creating

Ali | Last updated: Mar 22, 2023 09:07PM UTC

Hi Hannah, Thank you for your reply. I was using a Collaborator Everywhere extension as my base/template, and you are right, seems I am using legacy API. Also seems like I need to make quite a bit change to use new API, so will check that and get back if I have further questions on this. Thank you

Ali | Last updated: Mar 23, 2023 04:28AM UTC

Hi Hannah, I have updated my code to test with new Montoya API, used HttpRequest withUpdatedParameters() method for updating JSON parameter and get a new copy of the request with updated parameter. However, I have got same error message "java.lang.UnsupportedOperationException: Action is not supported for this parameter type" with of course different stack dump (used new method). Can you confirm new API actually has any method to update JSON request parameter? Because looking at HttpParameter interface documentation linked below it looked like cookie, body and url parameters are supported for creation and update but JSON and XML kinda params are not (same as the legacy API) https://portswigger.github.io/burp-extensions-montoya-api/javadoc/burp/api/montoya/http/message/params/HttpParameter.html

Hannah, PortSwigger Agent | Last updated: Mar 27, 2023 01:24PM UTC

Hi After doing some testing, it looks like this is not currently possible in either the legacy Extender API or the Montoya API. We'll raise a feature request to add this functionality. You could instead retrieve the body of the request and use String manipulation (e.g. replaceAll) to match the intended text and replace it.

Qusec | Last updated: Oct 19, 2023 08:05AM UTC

Hi, Is there any update on this? or even if beta implementation is available? Thanks

Hannah, PortSwigger Agent | Last updated: Oct 19, 2023 09:29AM UTC

Hi. We'd still recommend using a library for JSON or String manipulation to update the raw body of the request. We don't currently have any plans to change this in the short term. However, I have added your additional +1 to this ongoing feature request. If there's anything else we can help with in the meantime, please let us know.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.