Burpsuite does not show anything when i send request into autorepeater

[anhkhoa14592]

Hi nccgroup, I've tried your extension but it looks like the function does not work. i wonder if there is any requirement? Thanks

[justinmoore]

Hey there,

The readme doesn't really reflect and I'll be sure to update it to include some more broad instructions but AutoRepeater won't resend or display requests sent to it unless there's a defined replacement set that alters the request sent to it. This is to prevent AutoRepeater from repeating requests which won't be changed.

Does setting a replacement for your request fix it or is there another issue with how a certain type of replacement is implemented?

[ghost]

@m00r3 I also found the same issue. I added a condition with match and replace for headers and then sent a particular request to AutoRepeater, but the request is not shown in the pane. I also tested a variety of other rules with and without regex - string, in scope, etc, but doesn't seem to make a difference. However, there are no errors in the Extender tab.

[justinmoore]

@rsmith31415 Can you please try using a header replacement rule from the proxy match and replace settings? To do header replacements without a regular expression you need to enter the entire header value into the find location.

[ghost]

@m00r3 Hopefully, this is what you mean: I added a new rule to change a header value in "Proxy" -> "Options" -> "Match and Replace", and added a "Request header" rule to change the header "Upgrade-Insecure-Requests" from "Upgrade-Insecure-Requests: 1" to "Upgrade-Insecure-Requests: 2" and that works correctly. When I try to create a similar rule in AutoRepeater, I don't see the new request in the "AutoRepeater" tab.

[justinmoore]

@rsmith31415 I think I've sorted out the cause. It looks like there's a bug with the "Send To AutoRepeater" functionality. Resending the following request from Repeater

GET / HTTP/1.1 Host: www.google.com User-Agent: curl/7.51.0 Accept: */* Upgrade-Insecure-Requests: 1 Connection: close

with an AutoRepeater replacement configured with

Type: Request Header Match: Upgrade-Insecure-Requests: 1 Replace: Upgrade-Insecure-Requests: 2 Which: Replace First Regex Match: Not selected

and an AutoRepeater Condition set to

Boolean Operator: Match Type: Sent From Tool Match Relationship: Burp Match Condition:

I was able to get AutoRepeater to correctly perform the replacement. Can you please try the above case to make sure that the only bug is within the "Send To AutoRepeater" functionality and not some other feature?

[ghost]

@m00r3 Yes, that works correctly.

By the way, I found that if you use the scanner and the request is matched by a condition, you will also see that request in the AutoRepeater pane. I'm pretty sure that's not an intended behavior.

[justinmoore]

@rsmith31415 So I've tracked down the source of the bug that causes "Send To AutoRepeater" not to work. I'll start working towards getting it fixed right away.

As for AutoRepeater picking up requests generated by scanner, that is intended functionality but it shouldn't be enabled by default. In the update that fixed "Send To AutoRepeater" that will also be fixed.

[justinmoore]

@rsmith31415 Can you give it another go with the updated AutoRepeater.jar. Hopefully both of the above issues should be fixed now.

[ghost]

@m00r3 Great. Now it behaves correctly. However, I found several edge cases in requests with multipart/form-data, but I will create a new issue to describe the problem.

[justinmoore]

perfect and thanks. I'll close this issue and look into the other one.