The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Line Feed not showing in response window

Sandro | Last updated: Jan 26, 2017 10:18AM UTC

Recently we tested a website for CRLF problems, when sending GET /%23%0dSet-Cookie:%20test=test%20HTTP/1.1 ... the Server answers with an redirect to Location: xxx/#%0dSet-Cookie:... Burps Response Window is hiding the %0d (Line Feed). The 0d is visible in the Hex View. That way the tester thinks the server is not vulnerable, but it is (at least for some browsers). Tested on Debian SID (OpenJDK 1.8.0_111) with Burp Pro 1.7.16

Burp User | Last updated: Jan 27, 2017 08:15AM UTC

As further explanation, the server sends an 0x0d between "/#" and "Set-Cookie", not an (encoded) %0d. I thought burp would show an illegal char not nothing (like vi or other text editors do it).

PortSwigger Agent | Last updated: Jan 27, 2017 09:03AM UTC