Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

session handling rule set parameter value in json

Wouter | Last updated: Nov 19, 2018 08:44AM UTC

For Burp Suite 2.0.12beta: A session handling rule (Project Options -> Sessions) that takes care of setting the value of a given parameter in http requests is not applied to request bodies in json format. In the request example below, I have tried to replace the value of the parameter "_csrf": POST /api/bla/info/update HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://example.com/bla Content-Type: application/json;charset=utf-8 Content-Length: 336 Connection: close Cookie: rack.session=bla; {"block_info":{"id":80466,"caseholder":22,"report_year":2000,"extra_info":"adsfafa","polelength":100,"coverage":50,"type_of_foundation":"Test fundering","type_of_mat":"Onbekend","dry_period":true,"dummy_ready":false,"collecting_information_ready":true},"_csrf":"yKvR059TxRxH4oCGfu9kljdfCevF7PACuHyzVYAAs="} which did not work. Furthermore, sending the above request to the repeater and clicking the "Params" tab also revealed that the parameters in the json request body are not recognized.

PortSwigger Agent | Last updated: Nov 19, 2018 09:05AM UTC

The built-in session handling rules aren't able to update JSON parameters. However, there are a number of extensions that add capabilities to the built-in functionality. For example, the Custom Parameter Handler extensions, which is in the BApp Store, can do this.

Burp User | Last updated: Nov 19, 2018 12:11PM UTC

Any plans to include this functionality in burp suite? In my opinion this is basic functionality.

PortSwigger Agent | Last updated: Nov 19, 2018 01:56PM UTC