Skip to content

b4dpxl/burp-url-reflection-detection

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 

Repository files navigation

URL Reflection Detection

BurpSuite semi-passive extension which adds a new, random querystring to all requests, and looks for this reflected in the response. I found that Burp wasn't always picking up URLs and querystrings being reflected, so this attempts to resolve this by adding an explicit marker.

The new parameter takes the format ?__canary=abcdefgh, and an issue will be raised if it's matched in the response header and/or body. A comment will also be added to the requests to indicate it's been added, as it won't show up automatically.

Other extensions like Reflected Parameters will also pick up the reflection.

This is disabled by default, as some apps don't like it. Use the new "Reflect/Detect" menu to enable it, and limit it to only in-scope requests (this is enabled by default).

About

Burp extension to detect URL reflection

Topics

Resources

Stars

Watchers

Forks

Languages