Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Non-ascii http2 header value is incorrectly handled

ttera | Last updated: Oct 24, 2022 12:18AM UTC

Burp converts non-ascii http2 header value to "?" (0x3F). Example PHP code to reproduce the bug: ---------------------- <?php header("Location: https://aaa\xFF.bbb"); ---------------------- Burp shows: ----------------------- HTTP/2 302 Found Location: https://aaa?.bbb ----------------------- Hex value for "?" is "3f" on Burp's Hex tab (it must be 0xFF, not 0x3F). This is confusing when testing non-ascii attack patterns. Note that cURL tells that actual byte is 0xFF. ----------------------- 0000: 6c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a location: https: 0010: 2f 2f 61 61 61 ff 2e 62 62 62 0d 0a //aaa..bbb.. location: https://aaa▒.bbb -----------------------

Hannah, PortSwigger Agent | Last updated: Oct 25, 2022 10:45AM UTC