The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Trouble replicating burp suite requests and questions about where it gets its data

Wout | Last updated: Mar 21, 2024 12:37PM UTC

Hey all! I have recently tried to replicate a result from a burp suite scan, which reported Out-of-band resource load. Looking at the request and response, it does not seem like a false positive. So I tried to replicate this requests, to determine if it leads to access to pages that are not publicly visible, etc. However, I'm not able to. The api keeps giving an error. This is the request (DISCLAIMER: I have full permission to run these tests against the website): GET /api/proxy?url=http%3a%2f%2fquobg2dj6jon3i9vro701syeb5hy53tthk4asz.oastify.com%2fnieuws%2frss&proxyToken=8251710882559146825&callType=rss&preventCache=1710859146825&token=uqnf-gWU2F5z6-yj3INy9QcvwQTH0KGLbF7e1XmCVaVL-cmQRwZ07-5aunWDrKM_r7OOlg-fqaNN_D6w_IEo45yEWCSKOXjYESa5hLPSjbY1 HTTP/1.1 Host: community.vera.be Accept-Encoding: gzip, deflate Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50 Safari/537.36 Connection: close Cache-Control: max-age=0 Cookie: ASP.NET_SessionId=im5gr1tbbq4fypqjojqanemp; __RequestVerificationToken=07o9v_Z3hqxzOBhBQNNNkV42ih-4Tm51t5lL9uZaHZt2OXNhTAJrigZva6hkcDFV_9mfyzjhgFrIgugNk136qXnogEkrqijAOqyEdoOIKu81; __AntiXsrfToken=b8413c6c356246b9b582cf8b12a50eb3; _pk_id.1.f891=e468d48fbc061a78.1710859145.; _pk_ses.1.f891=1 X-Requested-With: XMLHttpRequest Referer: https://community.vera.be/default.aspx Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="112", "Chromium";v="112" Sec-CH-UA-Platform: Windows Sec-CH-UA-Mobile: ?0 I think it has something to do with the parameters in the url of the request, but I have real trouble populating these with values of a new session. How did burp obtain these variables in the first place? I cannot find them in the html, cookies, ... Thanks for any answers!

Syed, PortSwigger Agent | Last updated: Mar 21, 2024 04:12PM UTC