Connection state attack Custom Action for Burp Repeater

connection-state-attack.bambda

// For context check out https://portswigger.net/web-security/host-header/exploiting#connection-state-attacks
var connectionId = utilities().randomUtils().randomString(8);
var options = RequestOptions.requestOptions().withConnectionId(connectionId).withHttpMode(HttpMode.HTTP_1);

// Send a simple GET / HTTP/1.1 to the target as the precusor request
var url = requestResponse.request().url();
var precursorRequest = HttpRequest.httpRequestFromUrl(url); 
precursorRequest = precursorRequest.withPath("/").withHeader("Connection", "keep-alive");

// Send the attack in the repeater, and update the response pane
api().http().sendRequest(precursorRequest, options);
var response = api().http().sendRequest(requestResponse.request(), options);
httpEditor.responsePane().set(response.response().toByteArray());