Burp Suite, the leading toolkit for web application security testing

Response Extraction Rules

Response extraction rules are used in various locations within Burp, to define the location within a response of a varying item that needs to be extracted. They are used to identify a custom session token in Sequencer, define an extract grep item in Intruder, and specify the location of a custom parameter value in a macro.

Because response extraction rules are designed to extract the same item from multiple responses that may differ in various ways, Burp provides very flexible ways of specifying the item's location.

The dialog to define an extraction rules shows the current configuration in the top panels, and a sample response in the lower panel. If the response has not yet been fetched from the target application, you can click the "Fetch response" to do this.

The easiest way to specify the item's location is simply to select it within the sample response. Provided the box "Update config based on selection below" is checked, Burp will then automatically create a suitable configuration in the top panels.

In some situations, you may need to modify the configuration manually, to ensure that it works when different responses are received. The following options are available:

When you manually modify the configuration in the upper panels, Burp automatically highlights within the response the item that will be extracted (if any).

When you have completed the configuration, you can click the "Refetch response" button a few times to test the configuration. Burp will then refetch the response and automatically highlight the item that will be extracted, so that you can confirm that the configuration is working as intended.

Support Center

Get help and join the community discussions at the Burp Suite Support Center.

Visit the Support Center ›

Thursday, March 12, 2015


This release contains various bugfixes and minor enhancements, including:

  • In the site map table, the "Method" column previously always showed GET for requests without a body, and POST for requests with a body, even if the actual method was different. This bug has now been fixed and the table shows the correct method.
  • A bug which prevented client SSL certificates from being used when an upstream proxy is configured has been fixed.
  • A bug which caused Decoder to fail to decode hex number HTML entities containing an upper-case X has been fixed.
  • See all release notes ›

Copyright © 2015 PortSwigger Ltd. All rights reserved.