Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Support Multiple Responses for Out of Session in Session Handler

Tony | Last updated: Jun 07, 2022 03:33PM UTC

The Session Handler provides 3 options to identify in the response that the session has terminated: HTTP Headers, Response Body, and/or URL Redirect. However, some large applications provide various responses indicating the session has been terminated. I recently tested a large web app that included 3 separate responses for a terminated session depending upon where in the app that was being scanned (e.g., APIs vs HTLM static content). I spent a lot of time creating a regex value with all 3 options (HTTP Headers, Response Body, and URL Redirect) to include all 3 response types, which wasn't clear if it actually worked correctly. Would it be possible to identify multiple responses specifying the response type to indicate out of session? This would make this process much easier for the tester and spend more time on testing than troubleshooting the regex during a scan. That may sound "lazy" with not improving my regex skills, however, we are time limited on our app pentests, so this would be helpful in clearly stating the responses that indicate a terminated session and not spending time on troubleshooting and rescanning.

Michelle, PortSwigger Agent | Last updated: Jun 08, 2022 12:35PM UTC