burp | simple php router that works with uri , query string | Router library

You could use COALESCE(), since GROUP_CONCAT() output is NULL for 0 results:

The problem you have described goes by the name parameter pollution. It is a bit bug, a bit feature of the web servers. It may have security implications if - for example - your filter layer checks access rights on the first occurrence of the userid attribute, but the business logic takes the last occurrence of the attribute. You will get an inconsistency that may be exploited.

If you are vulnerable to such type of attack - for me it is a strong evidence that you are doing something wrong inside the code, like you take the message body and extract the attributes manually from the POST requests and you do it different way in two different parts of your code.

If you don't do anything really stupid, this kind of attacks will not hurt the system and does not need any kind of mitigation code.

Unless you really must fix stuff like this, in which case I would say - take a WAF to clear the request before it even reaches the web server.

Yes, the HTTP/2 specification states, in section 8.1.2.2:

HTTP/2 does not use the Connection header field to indicate connection-specific header fields; in this protocol, connection- specific metadata is conveyed by other means. An endpoint MUST NOT generate an HTTP/2 message containing connection-specific header fields; any message containing connection-specific header fields MUST be treated as malformed

Having said that, many servers are more lenient and tolerate Connection headers to be present, although they are ignored.

The reason for this restriction is that the Connection header makes sense in an HTTP/1.1 request, where one request at a time was sent over a TCP connection.

In a multiplexed protocol like HTTP/2, it does not make sense for a request (a HTTP/2 stream) to carry connection headers, because there may be multiple requests on the same TCP connection.

As an extreme example, if you have an HTTP/2 stream with Connection: close and another, concurrent, HTTP/2 stream with Connection: keep-alive (although keep-alive is deprecated even in HTTP/1.1), what should an HTTP/2 implementation do? Close the connection as the first stream suggests, or keep it open as the second stream suggests?

Clearly this is not applicable to multiplexed protocols like HTTP/2, and that's why implementations reject such requests.

This is what I eventually did:

1. So I set up the browser with Foxy Proxy to point to Burp (127.0.0.1:8080)
2. Set in my Proxy Settings of Windows OS to use proxy pointing to my VPN IP
3. Set in the Burp the User Options tab in the Upstream Proxy Servers the IP of my VPN as well
4. Needed to configure self signed certificate with burp (their docs is a great resource)

So this way all my browser traffic goes through the local burp and he than goes through my VPN and I can successfully open my app page and intercept the traffic.
Also there is a hint just to filter/track traffic from specific site:

• Target tab > define the Target Scope to be the URL of your app
• Proxy tab > Options tab > in Intercept Client Requests check the one with the "And URL In target scope"

What Burp Suit does - it basically performs a Man-in-the-middle attack. It generates an HTTPS certificate and pretends to be a browser.

The thing is if your server and your client are protected from this MITM attack - those tools won't work. At least in the mobile apps - the browser will show a security error but still will pass the data through.

The solution you can use is including your specific SSL certificate into the app and making the app consider it to be the only trusted one. It will be more or less secure - depending on the implementation. It is also free because you can attach a self-signed certificate you created yourself since you control the verification. Naturally, the backend should also use the same SSL certificate. While using this technique Burp Suit generated certificates won't work because the app knows only one trusted certificate.

The technique itself is called SSL pinning or certificate pinning and you can find plenty of info online about how to implement it both on the client and server.

I will give you several links though:

Here is the nice article about how to do it with retrofit(okhttp).

Here is the official documentation for OkHttp CertificatePinner

Here is the small implementation of retrofit SSL pinning.

Here is one more article.

It is not enough but the issue is complex and one StackOverflow answer won't suffice. But I think it is a good start to do the actual implementation.

Also as a small recommendation - use encryption to store your SSL certificate key instead of plain string storage - it still won't be secure from memory spoofing but it will be much harder for the hacker to use it.

You can't use GROUP_CONCAT() as a scalar function; it must be used in the context of a set of rows. Similarly, you can't use any other aggregate function without a table reference:

As you know, burp, intercept a http/s protocol network and it isn't a tool for intercept network traffic. so To achieve your goal, you can use the wiresharkor something else, for finding a software rest api endpoint. After that, you can start your penetration testing using the burp as you did before.

so how you can find rest api endpoint in wireshark? you can filter network results, using this pattern:

Well, I managed to figure it out after finding some old posts on SO.

The code from This Post sets up an add_argument_group. You then add your args and hide the help text by setting help=argparse.SUPPRESS.

The actual text that is displayed in --help is the title and description of the group. This makes it very easy because you're just concatenating strings at that point and can add in your colorama styling easily with + where needed.

The code from the post: