Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Trouble replicating burp suite requests and questions about where it gets its data

Wout | Last updated: Mar 21, 2024 12:37PM UTC

Hey all! I have recently tried to replicate a result from a burp suite scan, which reported Out-of-band resource load. Looking at the request and response, it does not seem like a false positive. So I tried to replicate this requests, to determine if it leads to access to pages that are not publicly visible, etc. However, I'm not able to. The api keeps giving an error. This is the request (DISCLAIMER: I have full permission to run these tests against the website): GET /api/proxy?url=http%3a%2f%2fquobg2dj6jon3i9vro701syeb5hy53tthk4asz.oastify.com%2fnieuws%2frss&proxyToken=8251710882559146825&callType=rss&preventCache=1710859146825&token=uqnf-gWU2F5z6-yj3INy9QcvwQTH0KGLbF7e1XmCVaVL-cmQRwZ07-5aunWDrKM_r7OOlg-fqaNN_D6w_IEo45yEWCSKOXjYESa5hLPSjbY1 HTTP/1.1 Host: community.vera.be Accept-Encoding: gzip, deflate Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50 Safari/537.36 Connection: close Cache-Control: max-age=0 Cookie: ASP.NET_SessionId=im5gr1tbbq4fypqjojqanemp; __RequestVerificationToken=07o9v_Z3hqxzOBhBQNNNkV42ih-4Tm51t5lL9uZaHZt2OXNhTAJrigZva6hkcDFV_9mfyzjhgFrIgugNk136qXnogEkrqijAOqyEdoOIKu81; __AntiXsrfToken=b8413c6c356246b9b582cf8b12a50eb3; _pk_id.1.f891=e468d48fbc061a78.1710859145.; _pk_ses.1.f891=1 X-Requested-With: XMLHttpRequest Referer: https://community.vera.be/default.aspx Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="112", "Chromium";v="112" Sec-CH-UA-Platform: Windows Sec-CH-UA-Mobile: ?0 I think it has something to do with the parameters in the url of the request, but I have real trouble populating these with values of a new session. How did burp obtain these variables in the first place? I cannot find them in the html, cookies, ... Thanks for any answers!

Syed, PortSwigger Agent | Last updated: Mar 21, 2024 04:12PM UTC

Hi Wout,

If you have run a Crawl and Audit scan, then Burp gets them from the requests the app sends during the crawl. Apart from this, Burp injects the payloads it uses as part of the scan checks.

I hope that answered your question.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.