Fetch dynamic id from the past request's response and replace it in the new request #48
Description
I have a website that needs a 6 digit code .
to login .A dynamic ID is sent with the OTP submission request as "recoveryCode":"xxx" in the body. The dynamic ID for the next request is returned in the response of the first request as "recoveryCode":"xxx" in the body.I want to extract the dynamic ID ("recoveryCode":"xxx") from the response of the previous request, replace it in the body of the next request ("recoveryCode":"xxx") and continue this process for subsequent OTP submission requests.How can i achieve this using burp ATOR ,Don't just refer a blog/writeup regarding this but please explain step by step in detail
here is the request example
POST /recovery/continue HTTP/1.1
Host: example.com
Content-Length: 70
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
X-Event-Action: forgot-password
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
{"recoveryCode":"abcdefg123","otp":"122222"}
And the response of this request is:
HTTP/2 403 Forbidden
Date: Fri, 10 Jan 2025 21:07:16 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Content-Language: en-US
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=15552000; includeSubDomains
Surrogate-Control: no-store
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: 0
Etag: W/"12b-Lx9LS4LZfKlqrur/5aQexEL1bi8"
Cf-Cache-Status: DYNAMIC
Server: cloudflare
Cf-Ray: 8fffa2bc1cc3936b-MAA
Alt-Svc: h3=":443"; ma=86400
{"errorCode":"errors.com.example.account.account_recovery.authentication_exception","message":"The code is invalid or has expired. Please try again.","metadata":{"recoveryCode":"abcdefg54321"},"correlationId":"df1edac0-cf96-11ef-be05-f1faaa5bb1a5","numericErrorCode":18260}