Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Set Cookie on GET in Python Requests library

sensible | Last updated: Oct 14, 2022 04:34AM UTC

Hi all, I was doing the blind conditional SQL injection lab here. I wanted to program my own Intruder essentially, because the community Intruder is slow, and the lab has to bruteforce password letter by letter. I chose to use Python and its Requests library to automate this. I'm having trouble persisting cookies. From what documentation I could find, to set a cookie on a get request in the Requests library, I do: response = requests.get('https://0a33008004e5b1bac0f1224c008700c3.web-security-academy.net/', cookies={"Set-Cookie":"TrackingId=gRP6LjtV2TZ5T6N6}") however the response is always a new cookie and new session, not the one I set earlier. I'm trying to inject the TrackingId in the lab with SQL. the response I get for the cookie field is a lot longer with many more subfields. The code I'm using to see the cookie is : kookie = response.headers['Set-Cookie'] print ('COOKIE: ' , kookie) The Response: ('COOKIE: ', 'TrackingId=3Wr0Xudjecyt2KlD; Secure; HttpOnly, session=4OMFwcNlOz6Gz2dCpJE9Ws3PC8Dxt8id; Secure; HttpOnly; SameSite=None') Thus I'm not sure if my custom field for cookie is going through or not. It certainly isn't getting the 'welcome back' message I'm supposed to get. Please suggest anything for completing my Intruder in Python. I just need to have a persistent custom cookie field go through to the lab.

Hannah, PortSwigger Agent | Last updated: Oct 14, 2022 01:17PM UTC

Hi Have you had a look at the BApp Store extension "Turbo Intruder"? This is an extension that allows you to perform intruder-like attacks programmed in Python. It also uses its own network stack that has been optimized for speed.

Roopsagar | Last updated: Aug 19, 2024 01:39PM UTC