Enhancement - Differentiation of 302 based on the Location header

[aroly]

Hi there,

Currently (at least with the latest app available in Burp App Store) two 302 responses will be considered and shown as "SAME" in the result tab.

During my testing, I often see the case where two requests will receive 302, but for different reasons:

• the original request, for example to modify a profile page, will receive a 302 for the user to go back to the profile page.
• the other, modifed request will not be authorized but it will receive a 302 to the login page.

These pairs of requests/responses will appear in the result tab as "SAME". Ideally, an additional filter should be implemented to look at the "Location" header content. If these headers are different, the responses should be shown as "SIMILAR" or "DIFFERENT" but not "SAME".

Amazing work by the way, I really like your extension ! Thanks a lot !

Cheers,

A.

[simioni87]

Hello aorly, You are totally right. It is pretty difficult to find the best solution for this issue and therefore you are able to change the behaviour for the status calculation. Go to "Auth Analyzer --> Settings" (on the Burp menu bar) and unselect "Respect Response Code to flag with Status SAME" for your specific application...

Cheers

[aroly]

Hi,

Shame on me, I didn't even notice the settings menu. Thanks for the tip !

Cheers,

A.

[simioni87]

No worries, I am happy that I was able to help you ;-)