Tools · Web testing tools · 02 / 23
Intercept rules that pause only the lab
Intercept holds a request on screen before the lab app sees it. The useful setting is a rule that pauses Harbor Ledger posts and lets everything else go through, so you can read a message and forward it unchanged.
Two modes, used on purpose
With intercept off, Burp records and forwards in one motion. The browser feels normal. HTTP history fills in the order of a real visit. That is the right mode for learning Harbor Ledger’s map: sign in, open the invoice list, open April retainer, open the second invoice that also belongs to Avery, and stop.
With intercept on, matching requests wait in the Intercept pane. The application has not seen them. The browser waits with them. You use that pause when you already know the action you want to read, such as the note save, and you want a quiet look at the body before it is stored.
A rule that names the lab
An intercept switch with no condition pauses the next request the browser makes, whatever the host. On a lab profile that should be rare, and it is still a sloppy rule, because the browser will eventually ask for something that is not Harbor Ledger. The condition is the scope in miniature: host 127.0.0.1, port 3000, and, for this exercise, method POST.
GET stays unpaused so page loads finish. POST pauses so the note save, which is the state-changing action in this app, sits still long enough to read. Response intercept stays off until you have a reason to pause responses too. One pause at a time is enough.
Intercept client requests: on Match: all of the following Host name matches 127.0.0.1 Port matches 3000 Method matches POST Do not intercept server responses on this pass
Forward, drop, and the choice not to edit
Forward sends the request you are looking at. Drop discards it. The browser then shows a failure for that action, which is what you want when the paused host was not the lab. After a drop, fix the rule so the next click does not pause the same stray host.
The editor invites a change. This lesson does not take the invitation. The point of the pause is to see the note the form actually built: the path /api/notes, the content type, Avery’s cookie, and the note text. Forwarding unchanged means the history shows the app’s real behavior, which is the behavior you can describe to someone else.
Worked case: pause the note, then let it through
With the rule in place, sign in as Avery and type a short note you invented for the lab, such as “checked April retainer”. Click save. The Intercept pane should show POST /api/notes and the note in the body. Read the cookie. It should be the same lab session you saw on the invoice request. Click Forward. The app stores the note, and the history gains a completed row with a response.
If the pane stays empty, the rule did not match: check host, port, and method against the raw request once you find it in history. If the pane fills with GET requests for /static/app.js, the method condition is missing. If a host other than 127.0.0.1 appears, drop it. The lab note is the only message you forward in this pass.
Diagram
A request either pauses or passes
- Match
The intercept rule looks at host, port, and method. Harbor Ledger posts match. Other hosts do not.
- Pause
The request sits in the Intercept pane. The app has not seen it yet. The browser is waiting.
- Read
You read method, path, cookie, and body. This lesson forwards that text unchanged.
- Forward
Forward sends the bytes you see. The response comes back through the same pane if response intercept is on.
What intercept is doing while you click
Rule. Intercept is on, with no host condition.
Effect. Browser update checks and the lab app both stop on the pane.
Habit. People start editing whatever appeared, because the pane is in the way.
Rule. Host 127.0.0.1, port 3000, method POST.
Effect. Ordinary page loads complete. A note save waits for you.
Habit. You read the body, then forward it unchanged.
Intercept client requests: on AND host matches 127.0.0.1 AND port matches 3000 AND method matches POST Response intercept: off for this pass Action after reading: Forward
Check yourself
1. You are about to click through Harbor Ledger for the first time and you want the history to fill in the order a clerk would cause. Where should intercept be?
2. A paused request has Host: updates.browser.example. What do you do with it?
3. The rule matches POST http://127.0.0.1:3000/api/notes. The body is the note you typed in the form. What does Forward mean here?