Burp Suite Essentials

Matching

Filtering makes for a powerful analysis tool. But filtering happens after the requests have been sent, the responses received, and we just need to analyze the output. What if we want to make changes on the fly? Ideally, we would like to match certain data, such as requests, responses, parameter values, header values, and more. So, while the HTTP requests and responses are going through and coming back, we can create rules to match the data and perform operations on that data.

Let's look at all the places we can perform matching and related operations:

• In the Proxy | Options tab:
  • Under Intercept Client Requests
  • Under Intercept Server Responses
  • Under Match and Replace
• In Spider | Options:
  • Form Submission
• In Scanner | Options:
  • Attack Insertion Points ...