Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

The Web App I am testing has a drop down menu, how do I intercept this drop down menu behavior to poison it maybe?

Jennifer | Last updated: Sep 29, 2022 04:50PM UTC

I am testing a web app that offers a drop down menu that varies in its offerings based on if you are logged in as an admin or as a user. The admin menu is longer. I want to use comparer or something to goof around with priv escalation ideas. But that drop down menu is silent...sends no web requests....on the burp proxy. So I cannot really intercept that part. Is there a way to do this? It must be on the client side. I am not from a web dev background so I am on fuzzy on those details. On the advice of a coworker who knows marginally more, I am also looking at the WebSockets tab, but nothing there either.

Hannah, PortSwigger Agent | Last updated: Sep 30, 2022 01:21PM UTC

Hi Once you've made your selection on the dropdown, is there some sort of submit button that causes the page to refresh with the data from your selection, or does the page dynamically update once you've made your selection? Have you checked out any of the subjects in our Web Security Academy? https://portswigger.net/web-security

Jennifer | Last updated: Sep 30, 2022 04:12PM UTC

Thanks and No, unfortunately there is no submit button. You simply select the option with your mouse and click on that. Clicking on that will generate a request to a new area of the web app that the admin has access to. But there is no corresponding area for a user so I cannot compare. it is client side for sure. Seems like with the preponderance of drop down menus similar to this with modern frame works, there would be a way to exploit. Yes I am familiar with the Web Security Academy. I cannot locate anything to do with this issue there so far, or via google! :)

Hannah, PortSwigger Agent | Last updated: Oct 03, 2022 10:44AM UTC