[BUG] Replacing headers not working

[VitorDominguesR]

Current behavior

The usage of replacing headers is not working well. I try to remove the cookies from a request and replace by others, but it sometimes replace just part of cookies and maintain some.

Expected behavior

the feature replacing headers when set to remove cookie should remove all the cookies

Environment details

• Burp version:
• BCheck language version: v2-beta
• Operating system: macOS

Additional details

[Michelle-PortSwigger]

Hi

Thanks for getting in touch.

Would you be happy to share some more details of the BCheck you have created? If you'd rather share this directly with us, feel free to email support@portswigger.net.

You mentioned that sometimes some cookies are not removed, when does this happen? Is it when you perform an audit-only scan? If so, are the cookies that are still present ones that are also stored in Burp's cookie jar (Settings > Session > Cookie jar > Open cookie jar)?

[VitorDominguesR]

Hi Michelle,

This issue happened when I was creating a BCheck.

I used the replacing header to replace cookies for another ones.

I used this template to test in an application using a Custom Scan only with this BCheck.

Observing the Logger, i noticed that the cookie that I tried to replace was only partialy replaced.

Example:

Cookie I want to replace

Cookie: userSession=abc; otherCookie=zzxc;

My BCheck using replacing header:

replacing header:
        Cookie: otherCookie2=aaaaa

Actual result:

Cookie: otherCookie2=aaaaa; userSession=abc; otherCookie=zzxc;

or

Cookie: otherCookie2=aaaaa; otherCookie=zzxc;

[Michelle-PortSwigger]

Hi

Thanks for the update.

• Which type of BCheck did you create(e.g. Host level, path level, insertion point level)?
• Did you want the whole cookie header to be replaced with Cookie: otherCookie2=aaaaa so that was the only cookie present?
• What do you see if you test the BCheck in the editor? Does it change the header in the way you expect?
• Were you performing a crawl and audit scan or an audit-only scan?

[VitorDominguesR]

1. I think it can be considered path level because I am only replacing cookies to test Improper Authorization to access unauthorized resources
2. Yes, that was the goal. This otherCookie2 is just an example, but there are more cookies after the replaced ones.
3. The same behaviour, the cookie is partially replaced.
4. Audit-only scan.

[Michelle-PortSwigger]

Thanks for the update, if you test using the following syntax, does this help?

replacing headers:
        "Cookie": "otherCookie2=aaaaa"

If not, would you be happy to share the full BCheck with us (if you'd prefer to share this directly, please email it to support@portswigger.net)?

[Michelle-PortSwigger]

Hi

Thanks for sending the extra details over via email.

I thought I'd reply here too though. I think there's a possibility that the additional cookies are being added as they exist in Burp's Cookie jar. When using the test in the custom scan check editor or when performing an audit only scan, the default session handling rule will therefore add them in after your BCheck changes have been made.

[VitorDominguesR]

Hi Michelle,

Do you think that, if its the case, the Bcheck could have an option or something like that to choose to use the cookie jar or not ?

[Michelle-PortSwigger]

The cookie jar is only used for audit-only scans, when the default session handling rule will apply (crawl and audit scans will handle the cookies within the scan task and will not use the cookie jar).

If you are using audit-only scans, you can enable/disable the session handling rule or edit the scope of it by going to Settings > Sessions > Session handling rule.

I hope this helps. Please let us know if you have any further questions.

[Michelle-PortSwigger]

The other thing to remember is that when you're using 'Run test' in the Custom scan check editor, the Scanner is sending a request as it would in an audit-only scan (so the default session handling rule would cause the cookies in the cookie jar to be used in that scenario too).