Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Update Authorization header in requests to Scanner/Repeater

Syed | Last updated: Dec 06, 2021 09:35PM UTC

Hi, TL;DR: Trying to update subsequent requests with updated session information after session times out (in scanner/repeater) - Basically won't have to re-login and rerun the requests. I've followed (https://portswigger.net/support/configuring-burp-suites-session-handling-rules) and was able to fetch the updated cookies after the login fails but the session is actually being checked with the Authorization header with a JWT token. How can one actually replace other headers in the scanner once the session times out? I was successfully able to get the updated cookies but there's an Authorization header too which actually contains the authentication token. I can fetch the updated JWT through a macro but can't update my scanner requests with it.

Liam, PortSwigger Agent | Last updated: Dec 07, 2021 10:28AM UTC

Have you checked out the BApp Store? It contains extensions to be used in Burp. You can find it in Burp under "Extender > BApp Store" or on our website here: https://portswigger.net/bappstore There are several different extensions relating to JWT and authentication - you would likely need to read the descriptions to see if there's one in particular that best suits your use case. It sounds like the "Add custom header" or "JSON Web Token" extensions may be helpful.

Syed | Last updated: Dec 09, 2021 08:46PM UTC

Thanks Lian, Add custom header extension was all I needed. Took me some time to make the macros and everything work the way I wanted them to. I've made a video demonstrating the whole process. Leaving it here in case someone stumbles across the same issue in the future: https://www.youtube.com/watch?v=kmPllhwUdns

Liam, PortSwigger Agent | Last updated: Dec 10, 2021 11:17AM UTC

Thanks for letting us know, Syed!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.