Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Make 'WebSockets history' able to filter opcodes

Thorben | Last updated: Aug 21, 2024 01:18PM UTC

Hi, in an assessment I had to pentest an application which uses websockets. After a bit of fuzzing I found out, that a invalid payload caused the application to close the websocket-connection with an stack-trace. Sadly I saw the stack-trace only in my self-written client (using python 'websocket'-module and 'websocket.enableTrace(True)' ). Burp didn't show the error message. With a bit of research I found out that the error-message was send with an opcode 8 but Burp seems to show only opcode 1 in the history tab. I can understand that showing all other opcodes could mess up the history tab. But missing the error-message made me wonder: Can you please make the history tab able to filter opcodes? Default could still be opcode 1 only, but it would be nice to be able to see all other opcodes if needed. Thanks

Hannah, PortSwigger Agent | Last updated: Aug 22, 2024 09:56AM UTC

Hi We do filter out control frames from WebSocket traffic passing through Burp. If you're interested, we can raise a feature request to not filter opcode 8 (connection close) messages, and surface the opcode? We would be raising this feature request to monitor the level of interest in this functionality, to help us prioritize this work in the future. We would not be able to provide an ETA for when we would be able to implement this functionality.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.