You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
The extension ignores a 404 response and reports the dev console as being exposed when it shouldn't.
To Reproduce
Steps to reproduce the behavior:
Request:
GET /graphiql HTTP/1.1
Host: dvwa.test
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=0
Response:
HTTP/1.1 404 Not Found
Date: Fri, 31 Jan 2025 08:56:12 GMT
Server: Apache
X-Powered-By: Express
Content-Type: text/plain;charset=UTF-8
Content-Length: 25
Cannot GET
/graphiql.php?
This is reported as an issue because of the string match of graphiql in the response even though the response is a 404.
The php extension is just because I had to use a rewrite rule to get this working on my test server, it does the same on a live client site where it returns just /graphiql?.
Expected behavior
Detect 404s and do not report on them.
Screenshots
Desktop (please complete the following information):
Burp 2025.1 on Ubuntu
The text was updated successfully, but these errors were encountered:
Describe the bug
The extension ignores a 404 response and reports the dev console as being exposed when it shouldn't.
To Reproduce
Steps to reproduce the behavior:
Request:
Response:
This is reported as an issue because of the string match of
graphiql
in the response even though the response is a 404.The
php
extension is just because I had to use a rewrite rule to get this working on my test server, it does the same on a live client site where it returns just/graphiql?
.Expected behavior
Detect 404s and do not report on them.
Screenshots
Desktop (please complete the following information):
Burp 2025.1 on Ubuntu
The text was updated successfully, but these errors were encountered: