Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to update the Multipart Attributes parameter correctly?

fa1ntStar | Last updated: Nov 10, 2021 09:14AM UTC

Dear support, I'm working on an extension that modifies the multipart attributes of a file that is uploaded via a multipart request. See the example request below: POST /doUpload.action HTTP/1.1 Host: 192.168.31.171:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------3297196947930723492622433018 Content-Length: 839 Origin: http://192.168.31.171:8080 Connection: close Referer: http://192.168.31.171:8080/doUpload.action Cookie: JSESSIONID=1s26nmfx3306dctknrgfonn02 Upgrade-Insecure-Requests: 1 -----------------------------3297196947930723492622433018 Content-Disposition: form-data; name="upload"; filename="Modify This Value!!!" Content-Type: application/octet-stream -----------------------------3297196947930723492622433018 Content-Disposition: form-data; name="caption" -----------------------------3297196947930723492622433018-- I'm want to modify the the value of filename by BurpSuite Extender API,but when I try to update the "PARAM_MULTIPART_ATTR" parameter, I'll catch a "java.lang.UnsupportedOperationException",so how can I update the Multipart Attributes parameter(like filename) correctly？See the code below: List<IParameter> parameters = helpers.analyzeRequest(messageInfo.getRequest()).getParameters(); Iterator iterator = parameters.iterator(); while (iterator.hasNext()){ IParameter oldParameter = (IParameter) iterator.next(); if (oldParameter.getType()==IParameter.PARAM_MULTIPART_ATTR && oldParameter.getName().equals("filename")){ IParameter newParameter = helpers.buildParameter(oldParameter.getName(),"test", IParameter.PARAM_MULTIPART_ATTR); try { //updateParameter will throw java.lang.UnsupportedOperationException newRequest = helpers.updateParameter(newRequest,newParameter); } catch (Exception e) { return null; } } } Kind regards

Hannah, PortSwigger Agent | Last updated: Nov 10, 2021 01:13PM UTC