Filtering makes for a powerful analysis tool. But filtering happens after the requests have been sent, the responses received, and we just need to analyze the output. What if we want to make changes on the fly? Ideally, we would like to match certain data, such as requests, responses, parameter values, header values, and more. So, while the HTTP requests and responses are going through and coming back, we can create rules to match the data and perform operations on that data.
Let's look at all the places we can perform matching and related operations:
In the Proxy | Options tab:
Under Intercept Client Requests
Under Intercept Server Responses
Under Match and Replace
In Spider | Options:
Form Submission
In Scanner | Options:
Attack Insertion Points
In Intruder | Payloads:
Payloads Processing
We can set rules for intercepting client requests based on conditions. Basically, a rule has a Boolean operator, a match type, a relationship based on the match type, and the condition. By default...