Burp community forum

Request/response timing

tanyaka | Last updated: Mar 22, 2016 04:37PM UTC

Hi, I've been playing with java api to try and extract timing info for intruder sessions. Using the custom logger as a base I'm putting the request url and current time into a map, then when a response is received looking up the url in the map, getting the time and subtracting it from the current time. Is this a reliable way of approaching it? It seems to produce reasonable results.

PortSwigger Agent | Last updated: Mar 23, 2016 09:02AM UTC

This approach will probably work well enough in most situations, especially when any injected time delays are significantly longer than the normal response time. The current API is limited in not directly exposing this information, and at some point we will enhance the API to make this sort of task easier.

You need to Log in to post a reply. Or register here, for free.