Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Using sqlmap with Burp

Ricardo | Last updated: Aug 18, 2016 11:59PM UTC

Hi All, I have a SOAP API that require two unique parameters (Email and UserID). I'd like to use Burp to intercept the sqlmap request and replace these two parameters with random and sequencial numbers. Is that possible? Thanks! Ricardo Iramar

PortSwigger Agent | Last updated: Aug 23, 2016 10:50AM UTC

You could do this with a simple extension. Register an IHttpListener to get a handle to each HTTP request that Burp makes. For relevant requests (based on the URL or other means) update the relevant parameters with suitable random values. We do have a pending feature request to allow setting of random parameter values via a native session handling rule, but this isn't in our near-term roadmap, sorry.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.