Fix empty-bucket issue

PortSwigger · Feb 6, 2018 · 3d47012 · 3d47012
1 parent 4ebbebf
commit 3d47012
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 7 deletions.
diff --git a/resources/boring_headers b/resources/boring_headers
@@ -1,7 +1,8 @@
 host
-user-agent
+zcookie
+zuser-agent
 zreferer
-cookie
+zreferrer
 zvia
 zaccess-control-request-method
 zorigin
@@ -25,7 +26,6 @@ if
 proxy
 trailer
 waf-stuff-below
-referrer
 negotiate
 javascript
 action

diff --git a/src/burp/BurpExtender.java b/src/burp/BurpExtender.java
@@ -696,6 +696,11 @@ public byte[] buildBulkRequest(ArrayList<String> params) {
         String merged = prepBulkParams(params);
         String replaceKey = "TCZqBcS13SA8QRCpW";
         byte[] built = Utilities.addOrReplaceHeader(request, replaceKey, "foo");
+
+        if (params.isEmpty() || "".equals(merged)) {
+            return built;
+        }
+
         Iterator<String> dupeCheck= params.iterator();
 
         while (dupeCheck.hasNext()) {
@@ -705,6 +710,7 @@ public byte[] buildBulkRequest(ArrayList<String> params) {
                 built = Utilities.replace(built, toReplace.getBytes(), ("old"+toReplace).getBytes());
             }
         }
+
         return Utilities.setHeader(built, replaceKey, "x\r\n"+merged);
     }
 }

diff --git a/src/burp/ParamAttack.java b/src/burp/ParamAttack.java
@@ -368,14 +368,11 @@ ArrayList<String> calculatePayloads(IHttpRequestResponse baseRequestResponse, Pa
 
 
         if (type == Utilities.PARAM_HEADER) {
+            //bonusParams.addSource("User-Agent\nCookie\nHost\n");
             bonusParams.addSource("/Users/james/Dropbox/lists/favourites/request-headers.txt");
         }
 
         if (Utilities.OBSERVED) {
-//            int pad = params.size() % bucketSize;
-//            for (int i = 0; i<pad; i++) {
-//                params.add(Utilities.generateCanary());
-//            }
             if (type == Utilities.PARAM_HEADER) {
                 params.replaceAll(x -> x.toLowerCase().replaceAll("[^a-z0-9_-]", ""));
                 params.replaceAll(x -> x.replaceFirst("^[_-]+", ""));