Skip to content

Commit 1b4e5d1

Browse files
author
atomiczsec
committed
fixes missed vuln
1 parent c5ce8a9 commit 1b4e5d1

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

src/main/java/burp/RequestSender.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -260,9 +260,12 @@ protected static InitialTestResult initialTest(IHttpRequestResponse message) {
260260
}
261261
}
262262

263-
// Neither simple appending nor normalization patterns worked
264-
BurpExtender.logDebug("Initial test failed: Neither appended segments nor normalization patterns returned similar content");
265-
return InitialTestResult.failure("Backend rejects extra path segments and normalization patterns");
263+
// Neither simple appending nor normalization patterns worked at the backend level
264+
// However, cache normalization discrepancies can still be exploited even if the backend
265+
// doesn't normalize. We'll allow testing to continue - the cache-specific tests will
266+
// catch vulnerabilities where the cache normalizes but the backend doesn't.
267+
BurpExtender.logDebug("Backend doesn't normalize paths, but continuing scan for cache normalization discrepancies");
268+
return InitialTestResult.success(randomSegment);
266269
}
267270

268271
/**

0 commit comments

Comments
 (0)