Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Scan via Intruder and update one parameter

Edward | Last updated: Oct 13, 2023 09:14PM UTC

Hello Team! Apologies for the vague subject...been trying to figure out a way to scan a JSON request but also updating a value to be unique upon each request. In general, I have a request like this: POST /foobar HTTP/1.1 Host: foo.bar Cookie: abc123 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Te: trailers Content-Type: application/json Content-Length: 123 { { "a": 1, "b": "0", "c": "1", "d": "2", "e": "3", "f": { "g": "random", "h": "123456789", "i": { "j": "random" }, "k": "0" }, "l": "O", "randomID": "abcdefgh-ijk-123-456-789:FOO:BAR1::1" } } I need update the randomID value on each request (to anything random but unique) but would like to scan each of the JSON key values (A through L). I was thinking maybe I could do something in intruder with pitchfork but doesnt seem like I can use a macro. Have any recommendations?

Hannah, PortSwigger Agent | Last updated: Oct 16, 2023 09:37AM UTC

Hi Could you provide some more information on how you wish to interact with this request outside of generating the random field? For example, are you wishing to run an Intruder attack against the request using other insertion points, or are you wishing to use the Scanner tool to audit the request?

Edward | Last updated: Oct 16, 2023 11:32AM UTC

I was attempting to use the Intruder attack using scan insertion points.

Hannah, PortSwigger Agent | Last updated: Oct 16, 2023 02:09PM UTC