login

Burp Suite, the leading toolkit for web application security testing

Options: HTTP

This tab contains settings to control how Burp handles HTTP redirections, streaming responses and status 100 responses.

Redirections

These settings control the types of redirections that Burp will understand in situations where it is configured to follow redirections.

The following types of redirection can be selected:

Note that Burp's behavior in following redirections to particular targets is determined by settings within each individual Burp tool (for instance, based on Target scope).

Streaming Responses

These settings let you inform Burp which URLs return "streaming" responses, which do not terminate. Burp will then handle these responses differently than normal responses.

Streaming responses are often used for functions like continuously updating price data in trading applications. Typically, some client side script code makes a request, and the server keeps the response stream open, pushing further data in real time as this becomes available. Because intercepting proxies use a store-and-forward model, they can break these applications: the Proxy waits indefinitely for the streaming response to finish, and none of it is ever forwarded to the client.

Streaming responses are handled in the following way by individual Burp tools:

For help configuring the list of streaming URLs, refer to the help on URL matching rules.

Two further options are available relating to streaming responses:

Streaming responses are often compressed using GZIP encoding - you can configure Burp to decompress this content via the normal options in the Proxy and Repeater configurations.

Note that you can also use the streaming responses support for handling very large responses that are not strictly streaming (such as binary file downloads), in order to bypass the store-and-forward proxy model and improve Burp's performance.

Status 100 Responses

These settings control the way Burp handles HTTP responses with status 100. These responses often occur when a POST request is sent to the server, and it makes an interim response before the request body has been transmitted.

The following settings are available:

Support Center

Get help and join the community discussions at the Burp Suite Support Center.

Visit the Support Center ›

Monday, January 16, 2017

1.7.16

This release adds various enhancements and fixes:

  • There is a new command-line option to launch Burp with a specified user configuration file.
  • A bug that was recently introduced that prevented license activation in headless mode has been fixed.
  • The Content Discovery function now correctly handles applications that have wildcard behavior for file extensions (e.g. those that return a specific response for admin.xxx regardless of the file extension). This eliminates the only known false positives reported by the new Content Discovery engine.

See all release notes ›

Copyright © 2016 PortSwigger Ltd. All rights reserved.