Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Http History does not record calls from browser to webapi on the target site

brian | Last updated: Nov 16, 2016 04:11PM UTC

I am using Burp Suite Professional 1.7.04 In an application that hosts a Silverlight component I can see calls to the component's host page in the Http History. The Silverlight component makes https REST API calls back to the same server and domain (I understand the API is hosted under the same web site). However, I cannot find how to get Http History to capture and record those requests. This is important for me as I need to assess the back-end services for vulnerabilities too. In all other respects the Http History records all calls from the browser to the in-Scope target. Am I missing anything. Are there any restrictions concerning Silverlight, REST services?

PortSwigger Agent | Last updated: Nov 16, 2016 04:23PM UTC

It sounds like the Silverlight component isn't honoring the configured browser proxy settings. In this situation, you can often use DNS-level redirection and Burp's invisible mode to intercept the traffic: https://portswigger.net/burp/help/proxy_options_invisible.html

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.