Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

unreliable spelling of Authorization: Bearer in requests leaving the BURP proxy

ILGUIZ | Last updated: Feb 20, 2018 02:10AM UTC

My attempts to proxy a couple of requests to a test salesforce instance (get auth token from test.salesforce.com, post an action to csXX.salesforce.com with "Authorization: Bearer TOKEN") got "401 Authorization denied". I temporarily changed my shell script to execute the POST request unencrypted to catch the contents of the request leaving the BURP proxy using Wireshark/NPCap. This showed that the outgoing request spelled the "Bearer" word in the lower case. While I tried experimenting with the UpdateToken extension (where I made a change to detect and correct the case change after calling the helpers.buildHttpMessage()), I restarted BURP and saw the "Bearer" word getting out of BURP unmodified, without the extension. I am concluding that BURP modifies the spelling of "Bearer" in some BURP launches. I did not update BURP between my launches above. I wonder if another BApp extension could auto-update on startup and correct its modification of the spelling?

Liam, PortSwigger Agent | Last updated: Feb 20, 2018 09:04AM UTC

Thanks for this report. Just to clarify exactly what is happening, would it be possible to send screenshots of this issue to support@portswigger.net?

Burp User | Last updated: Feb 20, 2018 05:49PM UTC

I sent a Wireshark/NPCap capture and its screenshots. I am starting to believe that it was an earlier version of the UpdateToken extension (probably the one I picked from the Zip file in the project's releases) that broke authentication on proxying to Salesforce. It was only yesterday when I recompiled the latest code of UpdateToken and installed it. The latest code of UpdateToken did change it Bearer rewrite to use the upper case Bearer (and Salesforce seems to acknowledge only the upper case spelling). https://github.com/alexlauerman/UpdateToken/commit/05194d2ab87d1b5ab66d3580de9647adb21a01cf

Liam, PortSwigger Agent | Last updated: Feb 21, 2018 10:05AM UTC

Ilhuiz, we haven't received any communication from you including screenshots. Would it be possible to send the message again: support@portswigger.net. Thank you.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.