How to Build HTTP Message? Are there more examples or existing rules available?

[JaveleyQAQ]

For example. some POC/EXP rules or CORS, XSS.

[ddwightx]

Prerequisites Reading:

• https://synfron.github.io/ReshaperForBurp/Rules.html#build-http-message
• https://synfron.github.io/ReshaperForBurp/Variables.html

---

Build HTTP Message allows you to create or edit an HTTP message by modifying multiple individual parts of the message within the same Then, unlike Set Variable or Set Value which can only make one modification per Then. Also, unlike Set Value, it does not change the current request/response that triggered the Rule. On the other hand, Set Variable and Set Value allow you to do more complicated operations like regex replace, or precise JSON and HTML manipulations via selectors.

Although you can start with an empty Starter HTTP Message, optimal usage would be to start with a mostly complete HTTP message that you'd use as a starting template by pulling it into the Starter HTTP Message field using a variable tag. Then you'd add Message Value Setters to change any parts of that template message to eventually construct the final request or response that you want to create. Given the ability to use variable tags, the starter message or any of the values you set can be pulled from variables you set, a file, or even the current request/response that triggered the Rule.

For example, let's say I have the below request stored in a global variable called example:

GET / HTTP/1.1
Host: example.com
Connection: close

Now I want to make this request a POST, change the path, add a body, and store that new request in a different variable called example_post. I can do all of that with a single Build HTTP Message Then.

Here is a Build HTTP Message Then that would accomplish this:

The resulting example_post would look like this:

POST /greeting/submit HTTP/1.1
Host: example.com
Connection: close
Content-Length: 11

Hello World

[tomdottom]

@ddwightx could you show a working example using a setter for Request Header (singular). I've tried many values for the destination, but cannot seem to get it to work.

[ddwightx]

@tomdottom Looks like there is a bug with setting a Request Header using Build HTTP Message. Will get that fixed. Thanks for asking about that.

Until that's resolved, an easy workaround is to set the Request Method (GET, POST, PUT, etc.) first even if it's the same as what you started with, then set the headers.

[tomdottom]

Thanks for that trick @ddwightx, seems to work around the issue.

Also of note, when setting a Request Body, are all headers from the request template supposed to be erased?

[ddwightx]

It shouldn't. I'm not seeing that issue. It is happening for you?

[tomdottom]

I will confirm exactly how it happens and open an issue with details.

[ddwightx]

I will confirm exactly how it happens and open an issue with details.

Thanks. Also please provide with that a rule export of it if you can without exposing too much.