Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scanner "X-Forwarded-For dependent response" check alters Content-Type?

Patrick | Last updated: May 31, 2016 07:33PM UTC

I'm seeing behavior from the active scan check for "X-Forwarded-For dependent response" that changes the effect of the request and seems likely to produce false positives. When the scanner sends the request with the added X-Forwarded-For header, it changes the content type. In lots of apps that intend to use JSON this will change the response, meaning that the test is going to be very noisy. Request 1: POST /someapp/somepath/save HTTP/1.1 Host: <redacted> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-CSRFToken: I7qjj8Iz3XwEEwu2gL4ZcePHMdNjOUD6 Content-Type: application/json;charset=utf-8 Referer: https://<redacted>/admin/ Content-Length: 1747 Cookie: sessionid=<redacted>; csrftoken=I7qjj8Iz3XwEEwu2gL4ZcePHMdNjOUD6 Connection: close Request 2: POST /someapp/somepath/save HTTP/1.1 Host: <redacted> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-CSRFToken: I7qjj8Iz3XwEEwu2gL4ZcePHMdNjOUD6 Content-Type: application/x-www-form-urlencoded Referer: https://<redacted>/admin/ Content-Length: 0 Cookie: sessionid=<redacted>; csrftoken=I7qjj8Iz3XwEEwu2gL4ZcePHMdNjOUD6 Connection: close X-Forwarded-For: 127.0.0.1 Notice the change to "Content-Type: application/x-www-form-urlencoded" As this app is expecting and enforcing json, it rejects the second message creating a FP in the diff between the responses. (Edit: Just noticed that the "User agent-dependent response" test does the same thing). Thoughts? Thanks, PST

PortSwigger Agent | Last updated: Jun 01, 2016 08:25AM UTC

Thanks for this helpful report. We'll investigate this issue and get back to you if we need any further information.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.