Tools · Web testing tools · 08 / 23
Logger: capture the lab, and filter the view
Logger records traffic from Burp’s tools in one table, which is how a Repeater send and the original browser call end up side by side. The capture rule and the view filter keep that table on Harbor Ledger.
A second log, with the tool name on the row
HTTP history answers “what did the browser do through the proxy?” Repeater answers “what did I send from this tab?” Logger answers “what did all of the tools I enabled do, in order?” After the Repeater lesson, you want that third answer. The browser’s GET /api/invoices/1042 and the replay that carries X-Harbor-Lab: replay-2 should appear as two rows, with different tool names, the replay second.
Open Logger before you repeat the request, or the earlier send will be missing and you will think the tool is empty. Capture is not retroactive for traffic that happened while capture was off.
Capture filter
Limit the tools to Proxy and Repeater for this exercise. A scanner or an intruder-style runner is not part of these lessons, and leaving those tools out of the capture means a later misclick cannot fill the table with a burst you did not intend to keep. Then set the capture filter to the lab: domain name matches 127.0.0.1, port matches 3000.
The proxy may still show a stray host in HTTP history, because the proxy log and the Logger capture are separate switches. That split is useful. History is the raw record of what the browser attempted. Logger is the working set you meant to study.
Capture from: Proxy, Repeater Capture filter, match all: Domain name matches 127.0.0.1 Port matches 3000 View filter: /api/ Find the replay: X-Harbor-Lab
View filter
The view filter is a search on the table you already captured. Type /api/ to keep the invoice calls and the note save, and to hide the stylesheet and the script. Type X-Harbor-Lab when you want only the replay you labeled. Clear the box when you want the page load back.
Write the active view filter into the note whenever you quote a count. “Three API calls” is meaningless if the reader does not know you had hidden the static files. “Three rows under the view filter /api/” is a claim someone else can check.
Worked case: find the replay on the shared clock
Enable the capture above. In the lab browser, signed in as Avery, open invoice 1042. In Repeater, send the labeled replay from the earlier lesson, or create that labeled send now from the history row. Return to Logger. The view filter X-Harbor-Lab should show one row, tool Repeater. Clear it and apply /api/. You should see the browser’s call and the replay, in that order, both for /api/invoices/1042.
Write the two times, the two tool names, and whether the owner field matched. If a third host appears in Logger, the capture filter is wider than the rule above. Tighten it before you continue. Logger is a copy of secrets as surely as history is. The project-file lesson is the rule for where this copy lives.
Diagram
Capture less, then filter what you captured
- Tools
Capture from Proxy and Repeater. Leave other tools out of this exercise.
- Capture rule
Host 127.0.0.1 and port 3000. Other hosts are not captured by Logger even if the proxy saw them.
- View filter
A search for /api/ hides static files inside the rows you did capture.
- Pair
The browser’s invoice GET and the Repeater replay with X-Harbor-Lab sit on consecutive rows.
How wide the Logger table is
Capture. All tools, no host condition.
Table. Stray hosts and static files bury the two invoice calls.
Later. The table is a second, messier copy of everything the browser did.
Capture. Proxy and Repeater, host 127.0.0.1, port 3000.
View. Search /api/ so the note save and the invoice calls remain.
Later. You can point at the replay by its X-Harbor-Lab header.
Capture from tools: Proxy, Repeater Do not capture from: other tools, for this exercise Capture filter, all of: Domain name matches 127.0.0.1 Port matches 3000 View filter: /api/ Optional view filter: X-Harbor-Lab
Check yourself
1. Why open Logger after you have already used HTTP history and Repeater?
2. Which capture filter matches the rule in this lesson?
3. The view filter is /api/ and you cannot see /static/app.js. What is true?