Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Query in Match and Replace

bullet | Last updated: Nov 06, 2022 03:02PM UTC

Hi I am trying to match when ever my browser goes out to https[:]//i.ytimg[.]com/vi/pvBY0IfgeYo/hq720.jpg...... to point at http[:]//3adps[.]com/repulsive.jpg 3adps.com is an apache site on my LAN. For this to work Under Proxy>Options>Match and Replace I have added two rules which will look for the literal type of i.ytimg.com and replace it with 3adps.com and a regex for \/vi\/.*.jpg with /repulsive.jpg HTTP\1.1 Though I could see the "Original Request" is "Auto Modified" as shown below, I could not understand why is the request is still reaching out to i.ytimg.com. Original Request ================ GET /vi/uRN9P0dOI6E/hq720.jpg?sqp=-oaymwEXCNAFEJQDSFryq4qpAwkIARUAAIhCGAE=&rs=AOn4CLDAsOWDKMbjY_IyXvAAk1PIA_V45g HTTP/2 Host: i.ytimg.com Connection: keep-alive Accept: image/webp,image/png,image/svg+xml,image/*;q=0.8,video/*;q=0.8,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_16) AppleWebKit/605.1.15 (KHTML, like Gecko) Accept-Language: en-gb Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate Auto Modified Request ===================== GET /repulsive.jpg HTTP/2 Host: 3adps.com Connection: keep-alive Accept: image/webp,image/png,image/svg+xml,image/*;q=0.8,video/*;q=0.8,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_16) AppleWebKit/605.1.15 (KHTML, like Gecko) Accept-Language: en-gb Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate

Hannah, PortSwigger Agent | Last updated: Nov 07, 2022 09:52AM UTC

Hi Does the response from the website match your "/repulsive.jpg" endpoint, or does it match your original endpoint?

bullet | Last updated: Nov 08, 2022 03:31PM UTC

The response still comes from Google saying that it does not know where repulsive.jpg is present. My question is when I change the host: field in HTTP request method why would it still go to the original destination? If it is because of the TCP three way handshake which it had already established, is there a way for me to force the connection to connect with the new server at 3adps[.]com/repulsive.jpg

Hannah, PortSwigger Agent | Last updated: Nov 09, 2022 01:30PM UTC