How to replace the value of http request parameter

[M00nBack]

I just found request.url.query, but didn't find a way to replace request parameters. I think it is important, for example, to detect log4j vulnerabilities in passive scanning.

[Hannah-PortSwigger]

Hi.

Could you clarify the specific parameters that you are interested in replacing?

If you're using an insertion-point BCheck, then any parameters will be used as an insertion point already.

Additionally, you can always use "regex_replace" to find and replace specific content in your request.

[M00nBack]

Thanks for answering!

Yes, insertion-point can indeed be used, but what I want is to be able to judge the value of the parameter before replacing it. I saw a similar problem at: #13

Using regex_replace is quite cumbersome.

[Hannah-PortSwigger]

Unfortunately, you're not currently able to retrieve the value of an insertion point.

We have been gathering feedback for improvements that we can make to BChecks, and this is a common request that people have been making. We've added your +1 to this feature request.

In the meantime, you may need to use regex_replace as a workaround.

If you're looking for Log4Shell specifically, then you could check out the "Log4Shell Everywhere" extension on the BApp Store, or the "Log4Shell Scanner" extension that was previously on the BApp Store. Unfortunately, this extension had to be removed from the BApp Store as the Log4Shell payload was triggering some anti-virus tooling.

[M00nBack]

There is another question, how to contribute the BChecks code? I only found a packaged jar, is BChecks ready to open source?

[Hannah-PortSwigger]

You can contribute BChecks to this repository to share your written checks with others.

Check out our contribution guide here!

It's not possible to modify the BCheck language - this is written within Burp's code, which is closed-source.