Tools · Web testing tools · 03 / 23
Reading Burp’s HTTP history
HTTP history is the time-ordered record of what the lab browser asked for. The skill is to filter it down to Harbor Ledger’s API and to read one row completely: method, path, account, status, and the field that answers your question.
One click is a list of rows
HTTP history is the time-ordered table behind the Proxy tab. Each row is one exchange: host, method, URL, status, length, and time. A single invoice page in Harbor Ledger is a document, a script, a stylesheet, and at least one call to /api/invoices/1042. The page you remember is the document. The data you need to check is usually the API row.
The site map, on the Target tab, groups those same exchanges by host and path. Use the map when you want the inventory. Use history when you want the order. A second visit to the same invoice appears twice in history and once in the map. Both facts matter, and they are answers to different questions.
Filter until one question fits on the screen
Turn on “Show only in-scope items” after Harbor Ledger is the scope. Then search for /api/invoices. Static files drop out. What remains is the list call and the detail calls. If you also hide the extensions js, css, png, and woff2, a sloppy scope still does not bury you in assets.
Filters hide rows. They do not delete them. Clear the search when you want the full visit back, for example when you are explaining why the document request and the API request are a pair. A screenshot of an unfiltered log is a poor note. A named filter plus one opened row is a good one.
Show only in-scope items: on Filter text: /api/invoices MIME types: JSON Status codes: any File extensions hidden: js, css, png, woff2
- Sort by time when you are reconstructing a click.
- Sort by status when you are looking for the row that failed.
- Click the row. Read the request pane and the response pane before you switch rows.
How to read the row you kept
Start at the request line: method and path. Then the Host header, which should be 127.0.0.1:3000. Then the Cookie, long enough to see that a session is present, without copying the value into your notes. Then the response status and Content-Type. Then the body field that answers the question. For an invoice, that field is owner, next to the id you already saw in the path.
Length and time are supporting columns. A JSON invoice that comes back with a tiny length and a 200 may be an empty object or an error wrapped as success. Open it. A long pause on /health may be the app struggling, which is a lab observation about the process you are running, and it is still just a row until you read it.
Worked case: three rows that are the whole visit
Sign in as Avery with intercept off and open the invoice list, then April retainer, which is invoice 1042, then Avery’s other invoice, 1048, titled March hosting. In history, apply the in-scope filter and the /api/invoices search. You should be able to name three JSON rows: the collection, 1042, and 1048. Each detail response should carry owner avery@ledger.lab, because both rows belong to the account you signed in as.
Write three lines, one per row, with method, path, status, and owner or, for the collection, the ids that came back. If an id appears that the list page did not render, say so, and quote that response. If a host other than 127.0.0.1 survived the in-scope filter, the scope is wrong, and the scope lesson is the next fix. You are done when someone else could find the same three rows with the filter you wrote down.
Diagram
From a full log to one exchange
- Unfiltered
A page load is many rows: the document, the script, the stylesheet, and the API calls.
- In scope
The scope filter hides hosts other than 127.0.0.1:3000.
- One path
A search for /api/invoices leaves the JSON calls and hides the static files.
- One row
You read that row’s request and response together before you write anything down.
Two ways to look at the same visit
Screen. Static files, the document, and the API are interleaved.
Risk. You describe the page from memory and miss the API the page called.
Note. “Opened the invoice” is the whole write-up.
Screen. GET /api/invoices/1042 is the row on screen.
Read. Status 200, JSON, owner avery@ledger.lab.
Note. The note names method, path, account, and owner.
Show only in-scope items: on Search: /api/invoices Hide: extensions js, css, png, woff2 Columns to keep: method, host, path, status, length, time
Check yourself
1. You loaded one invoice page and the history shows the document, app.js, app.css, and two API calls. Which view answers “what data came back”?
2. The in-scope filter is on and the search box says /api/invoices. What should remain?
3. A row shows 200 and a JSON owner of avery@ledger.lab. You signed in as Avery. What belongs in the note?