Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

UpdateParameter for body parameters removes multipart attributes such as filenames

PMwxVLDHhy6oiP | Last updated: Apr 12, 2021 01:16PM UTC

Dear support, I'm working on an extension that modifies the contents of a file that is uploaded via a multipart request. See the example request below: ``` POST /upload HTTP/1.1 Host: example.com ----------------------------356635205736610006839153 Content-Disposition: form-data; name="document"; filename="upload.pdf" Content-Type: application/pdf <file contents> ----------------------------356635205736610006839153-- ``` I wish to modify the file contents. To this end, I use the following statement (Jython): modified_request = self._helpers.updateParameter(self._baseRequest, \ self._helpers.buildParameter("document", "new file contents", IParameter.PARAM_BODY)) This correctly changes the file contents, but this loses the `filename` and `Content-Type` parameters. Is there a way to update the file contents whilst keeping the `filename` and `Content-Type` intact? Or to add these parameters manually? Kind regards

Uthman, PortSwigger Agent | Last updated: Apr 13, 2021 09:09AM UTC

Hi, Can you please share the full PoC code with support@portswigger.net?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.