Skip to content

Instantly share code, notes, and snippets.

View Spix0r's full-sized avatar
🕷️
Crawling...

Spix0r Spix0r

🕷️
Crawling...
View GitHub Profile
@albinowax
albinowax / connection-state-attack.bambda
Created October 16, 2025 13:24
Connection state attack Custom Action for Burp Repeater
// For context check out https://portswigger.net/web-security/host-header/exploiting#connection-state-attacks
var connectionId = utilities().randomUtils().randomString(8);
var options = RequestOptions.requestOptions().withConnectionId(connectionId).withHttpMode(HttpMode.HTTP_1);
// Send a simple GET / HTTP/1.1 to the target as the precusor request
var url = requestResponse.request().url();
var precursorRequest = HttpRequest.httpRequestFromUrl(url);
precursorRequest = precursorRequest.withPath("/").withHeader("Connection", "keep-alive");
// Send the attack in the repeater, and update the response pane