Research Academy Daily Swig
My account Customers Account and subscription management About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

how to update json parameters in request using Burp api?

| Last updated: Mar 18, 2023 12:51AM UTC

Hi there, I am writing an extension which needs to update request parameters value with new injected payload. For GET/POST requests, headers and cookies it was quite straightforward. However, dealing with POST requests containing JSON data I could not find any easy way, or a method to use. Reviewing documentation here https://portswigger.net/burp/extender/api/burp/iextensionhelpers.html I see methods like addParameter, updateParameter, removeParameter don't support PARAM_JSON or PARAM_XML etc. Am i missing something or only getting JSON parameters and values is supported by Burp API but add/update/remove them are not supported?

Hannah, PortSwigger Agent | Last updated: Mar 22, 2023 01:37PM UTC

Hi It looks like you are using the legacy Extender API. Have you had a look at the new Montoya API instead? You can find more details on this here: https://portswigger.net/burp/documentation/desktop/extensions/creating

| Last updated: Mar 22, 2023 09:07PM UTC

Hi Hannah, Thank you for your reply. I was using a Collaborator Everywhere extension as my base/template, and you are right, seems I am using legacy API. Also seems like I need to make quite a bit change to use new API, so will check that and get back if I have further questions on this. Thank you

| Last updated: Mar 23, 2023 04:28AM UTC

Hi Hannah, I have updated my code to test with new Montoya API, used HttpRequest withUpdatedParameters() method for updating JSON parameter and get a new copy of the request with updated parameter. However, I have got same error message "java.lang.UnsupportedOperationException: Action is not supported for this parameter type" with of course different stack dump (used new method). Can you confirm new API actually has any method to update JSON request parameter? Because looking at HttpParameter interface documentation linked below it looked like cookie, body and url parameters are supported for creation and update but JSON and XML kinda params are not (same as the legacy API) https://portswigger.github.io/burp-extensions-montoya-api/javadoc/burp/api/montoya/http/message/params/HttpParameter.html

You need to Log in to post a reply. Or register here, for free.