Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Update Authorization header in requests to Scanner/Repeater

Syed | Last updated: Dec 06, 2021 09:35PM UTC

Hi, TL;DR: Trying to update subsequent requests with updated session information after session times out (in scanner/repeater) - Basically won't have to re-login and rerun the requests. I've followed (https://portswigger.net/support/configuring-burp-suites-session-handling-rules) and was able to fetch the updated cookies after the login fails but the session is actually being checked with the Authorization header with a JWT token. How can one actually replace other headers in the scanner once the session times out? I was successfully able to get the updated cookies but there's an Authorization header too which actually contains the authentication token. I can fetch the updated JWT through a macro but can't update my scanner requests with it.

Liam, PortSwigger Agent | Last updated: Dec 07, 2021 10:28AM UTC

Have you checked out the BApp Store? It contains extensions to be used in Burp. You can find it in Burp under "Extender > BApp Store" or on our website here: https://portswigger.net/bappstore There are several different extensions relating to JWT and authentication - you would likely need to read the descriptions to see if there's one in particular that best suits your use case. It sounds like the "Add custom header" or "JSON Web Token" extensions may be helpful.

Syed | Last updated: Dec 09, 2021 08:46PM UTC

Thanks Lian, Add custom header extension was all I needed. Took me some time to make the macros and everything work the way I wanted them to. I've made a video demonstrating the whole process. Leaving it here in case someone stumbles across the same issue in the future: https://www.youtube.com/watch?v=kmPllhwUdns

Liam, PortSwigger Agent | Last updated: Dec 10, 2021 11:17AM UTC