Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Time based request

ARPIT | Last updated: Oct 19, 2023 07:06AM UTC

Hi Team, Does burp suite has any functionality wherein it can revoke either an extension or a request after a certain period of time? Or any extension having the functionality wherein it can send a request after a certain period of time? Thanks, Arpit

ARPIT | Last updated: Oct 19, 2023 07:06AM UTC

Sorry, where it can invoke** an extension.

Hannah, PortSwigger Agent | Last updated: Oct 19, 2023 09:20AM UTC

Hi Arpit. You can do a lot with extensions, so this would be possible. You may want to look at a ScheduledExecutorService to issue your request or perform an action with your extension, as this will be done on a separate thread, preventing lockups, and be performed after a specific time delay. I found the following guide that may be helpful: https://www.baeldung.com/java-executor-service-tutorial#ScheduledExecutorService Alternatively, your extension could provide a session handling rule action. This would mean that you could immediately invoke your extension after a specific request matching your session handling scope is made.

ARPIT | Last updated: Oct 25, 2023 12:55PM UTC

The suggestion you have provided is actually on a service. Before going there, do we have any functionality already in the burp suite? or a particular extension? I just want to invoke a particular extension after a certain period of time, while scanning. If you can help me with that. Does running a task help in that?

Hannah, PortSwigger Agent | Last updated: Oct 26, 2023 09:03AM UTC

Hi To use ScheduledExecutorService, you would need to write an extension to be used in Burp. Could you provide some more information on the overall task you are trying to perform? It may be that we could give you a better solution after knowing some more context.

ARPIT | Last updated: Oct 26, 2023 09:16AM UTC

My application consists of a complex login mechanism. While auditing, it logs out or the Session cookie is expired after 120 minutes. While initiating the scan, I set a legitimate cookie manually, in the session handling rule so that it can be used in the auditing. But, after 120 minutes it will expire. So I am trying to implement one idea: I will be using reshaper(Extension), Scope: Scanner, & look for the logged out request. Once that log out event is triggered, Stepper(Extension) will be executed & run that sequence to generate a new Session cookie. Query: I have to set that cookie coming out of stepper at two events: 1. When the scan is triggered(Beginning). 2. Whenever reshaper triggers the log out mechanism. That's why I asked, if you have anything that can carry out a request after a certain period of time.

Hannah, PortSwigger Agent | Last updated: Oct 26, 2023 04:25PM UTC

Thanks for that information! Depending on your login mechanism, you may be able to use a recorded login for authentication while scanning. You can find more information about this here: https://portswigger.net/burp/documentation/scanner/authenticated-scanning/recorded-login-sequences It may also be easier for you to configure a session handling rule. You can find these under "Settings > Sessions". You can chain actions together in a session handling rule to achieve a similar result. For example, you can use the "Check session is valid" rule to verify whether you currently have a valid session. If you don't have a currently valid session, you could then run a macro and extract the cookie appropriately. There are also some extensions available on the BApp Store that may help with this sort of functionality. For example: - Token extractor - TokenJar - Session Handler+

ARPIT | Last updated: Oct 29, 2023 06:41PM UTC

you can use the "Check session is valid" rule to verify whether you currently have a valid session. If you don't have a currently valid session, you could then run a macro and extract the cookie appropriately. Does this work in Auditing?

Hannah, PortSwigger Agent | Last updated: Oct 30, 2023 09:51AM UTC

If you set your session handling rule scope to include the Scanner, then this rule will act on your audit traffic as well. This may prevent you from scanning the site in an unauthenticated context, as you would always be in an authenticated state.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.