search

nccgroup / AutoRepeater

Automated HTTP Request Repeating With Burp Suite
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/january/autorepeater-automated-http-request-repeating-with-burp-suite/
MIT License
846 stars 107 forks source link

Tabs With Only Base Replacements Don't Fire #23

Closed jacobheath closed 6 years ago

jacobheath commented 6 years ago

Me again, Looks like when I have a bunch of base replacements, but no regular replacements, AutoRepeater doesn't capture requests properly. I've attached two configuration files that show this:

Working:

working.zip

Not Working:

not-working.zip

The scenario I am trying to get working is have an individual tab for each user session. Each tab needed several base replacements so that I could modify their CSRF token in the header and the numerous cookies the application uses to identity the user.

justinmoore commented 6 years ago

Hey,

I noticed this behavior earlier today. The reason it's like this is because originally all of the Base Replacements would get bundled up into one one request and get sent and then that request would get copied and each Replacement would get applied to it separately. This was causing extra outbound requests and was confusing. I changed it to have Base Replacements not send a request but I agree that the behavior isn't correct because it doesn't allow AutoRepeater to handle situations like the one you described.

I'll change the behavior to send the outbound request if a tab has Base Replacements defined but not Replacements to fix this.

Also, I think i've fixed the threading issue, i'll push both these fixes together in a few minutes.

Thanks, Justin

justinmoore commented 6 years ago

This should be fixed in the newest JAR now, I'll wait for confirmation before i close this.

justinmoore commented 6 years ago

I'll close this now. If there's any more issues feel free to reopen.