Category Archives: burp-suite

In Burp Suite, how can I filter traffic by a specific domain and also filter requests initiated by that specific domain?

Posted on by

In Burp Suite, how can I filter traffic by a specific domain, and also include requests initiated by that specific domain? For example, I want to filter:
www.example.com
But www.example.com initiated the request to www.x.com, so I want www… Continue reading In Burp Suite, how can I filter traffic by a specific domain and also filter requests initiated by that specific domain?→

Running zap scan on a web application is not detecting all endpoints

Posted on by

I want to run ZAP automated scan to a web application. I have the url which is example.com/myapp. When I browse the application in burpsuite, I can see some rest endpoints being called like example.com/authz/rights-administration/.
When ru… Continue reading Running zap scan on a web application is not detecting all endpoints→

Is it possible to run an active scan against a website with Burpsuite, ZAP, or another tool that excludes form submission for a single form? [closed]

Posted on by

I am trying to run an unauthenticated active scan of a website as part of a penetration test, and there is one form on the website on a contact page that looks like it will send emails to a singular contact. We don’t want to flood this per… Continue reading Is it possible to run an active scan against a website with Burpsuite, ZAP, or another tool that excludes form submission for a single form? [closed]→

Redirect all outgoing http and https requests to Burp using nftables

Posted on by

I’m working on a very limited client (based on Poky from the Yocto Project), on which I want to redirect all http/https requests to my other machine on the same network. I have nftables available on the target and verified this, by success… Continue reading Redirect all outgoing http and https requests to Burp using nftables→

cant set cookie from request to another domain, chrome third party cookies phaseout

Posted on by

I am doing the PortSwigger CSRF lab, where the token is tied to a non-session cookie, the solution to this is that we set a cookie to the users’ browser through the search field which sets the search query to set cookie
and then do a POST … Continue reading cant set cookie from request to another domain, chrome third party cookies phaseout→