Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scanning a "POST" causes a "GET" with no parameters

Don | Last updated: Apr 17, 2015 06:56PM UTC

I'm doing an active scan of a POST that has parameters for session ID, which is also stored in the cookie jar. However the attacks created by that scan produce "GET"s that have no parameters (no session ID) which causes my website to regenerate the session ID and thus subsequent attacks are all failing. So, how to I stop Burp Suite from generate a "GET" or alternatively have it include the session ID in the parameter?

PortSwigger Agent | Last updated: Apr 20, 2015 08:41AM UTC

Is the problem that the regenerated session ID that the application returns for the non-parameterized request gets added to Burp's cookie jar and then used in subsequent scan requests, causing a loss of the original session? If so, you can work around the app's behavior by configuring Burp not to update its cookie jar based on responses from the Scanner (at Options / Sessions / Cookie jar).

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.