Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Proxy Intercept and Get Requests (Lab: SQL injection UNION attack, determining the number of columns returned by the query)

Joshua | Last updated: Sep 29, 2020 05:33AM UTC

Hi! I'm doing the Lab: "SQL injection UNION attack, determining the number of columns returned by the query" and I've hit a problem with the intercepted information I've set up the proxy and certificate, but when I turn on intercept I only get the GET /academyLabHeader HTTP/1.1 - no matter what I navigate to, it's the only thing intercepted. Is there a setting or anything I am missing? Thanks!

Ben, PortSwigger Agent | Last updated: Sep 29, 2020 07:14AM UTC

Hi, What happens when you forward that particular request from within the Proxy -> Intercept tab in Burp? With the "Intercept is on" configuration set, Burp will stall all of the outgoing requests and will wait for you to perform some manual action on them. If there are a sequence of requests that load the page then Burp will be waiting for you to perform a manual action on the first request (like Forwarding the request) before showing you the next request in sequence.

Joshua | Last updated: Sep 29, 2020 08:03AM UTC

If I forward the request, the tab shows blank as if there are no more requests in the sequence.

Michelle, PortSwigger Agent | Last updated: Sep 29, 2020 03:31PM UTC

Once you've forwarded the request and no more requests appear in the Intercept tab, if you keep Intercept turned on and choose one of the search categories on the lab web page, you should then see a request for something like this: GET /filter?category=Pets HTTP/1.1 Please let us know how you get on.

Joshua | Last updated: Sep 30, 2020 02:45AM UTC

That's what I thought should happen, but unfortunately no matter which categories I select, I only ever get the GET /academyLabHeader HTTP/1.1 The page navigates to the selected category, and nothing else is intercepted. I forward the GET /academyLabHeader HTTP/1.1 and the screen returns to blank. Apologies if there is something obvious I am missing and thanks for the help!

Michelle, PortSwigger Agent | Last updated: Sep 30, 2020 07:55AM UTC

Can you see the request in the Proxy -> HTTP History tab? Have you changed any options under Proxy -> Options -> Intercept Client Requests? If it's easier to explain what you're seeing with screenshots or a screen recording, feel free to send an email to supoprt@portswigger.net and we can take a look.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.