Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Line Feed not showing in response window

Sandro | Last updated: Jan 26, 2017 10:18AM UTC

Recently we tested a website for CRLF problems, when sending GET /%23%0dSet-Cookie:%20test=test%20HTTP/1.1 ... the Server answers with an redirect to Location: xxx/#%0dSet-Cookie:... Burps Response Window is hiding the %0d (Line Feed). The 0d is visible in the Hex View. That way the tester thinks the server is not vulnerable, but it is (at least for some browsers). Tested on Debian SID (OpenJDK 1.8.0_111) with Burp Pro 1.7.16

Burp User | Last updated: Jan 27, 2017 08:15AM UTC

As further explanation, the server sends an 0x0d between "/#" and "Set-Cookie", not an (encoded) %0d. I thought burp would show an illegal char not nothing (like vi or other text editors do it).

PortSwigger Agent | Last updated: Jan 27, 2017 09:03AM UTC

Burp's raw text view doesn't show anything for non-printing characters, as you observed, so you'll need to use the hex view for this purpose. If you are sending payloads other than CRLF looking for the effect on header line endings, it would be preferable to look at the hex view in any event, so that you can see exactly what is going on.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.