Tools · Web testing tools · 09 / 23
Project files hold the lab session
A Burp project on disk is a full copy of the history, including Avery’s session cookie. A temporary project dies when you close the window. Either choice is safe only if you know which one you opened and where the file would go.
The choice is on the startup window
Burp asks, before any traffic, whether this session is temporary or a project on disk. Temporary means the history lives until you quit. Disk means a file grows as you browse, and it will still be there after a crash, which is why it is also still there after you thought you were done. For a single afternoon on Harbor Ledger, temporary is the default these lessons use.
Choose a disk project when you have a reason: the mapping walkthrough is long, you will continue tomorrow, or someone else on the same lab machine needs to see the same history. Name the file harbor-ledger-lab.burp and put it inside the lab folder. Write that path at the top of your notes so a later cleanup has a target.
What the file actually contains
Assume the file contains every request and response the enabled logs held. That includes Cookie headers, the JSON of Avery’s invoices, the note text you posted, and the scope and intercept rules. It is not a summary. It is the raw desk. Anyone who can open it in Burp can read the session and, while the lab still honors that session, repeat the calls.
A screenshot of the invoice page is a much smaller secret than the project file. When a write-up needs evidence, paste the four or five lines from the lesson on notes: method, path, status, owner, and the account. Point at the project path if a reviewer on the same machine needs the raw bytes. Do not attach the project to a message.
# lab/.gitignore *.burp *.burp-project # today’s note Project: temporary Lab: http://127.0.0.1:3000 Account used: Avery (seed) Delete rule: nothing on disk to delete
A file you did not create
A project created by someone else is their scope list plus their cookies. Opening it is reasonable only when the lab brief told you to open that file. The first screen to read is still Target scope. If the include line is not http://127.0.0.1:3000, stop. Do not “just see” a hostname because the file had it selected. Close the project and start a temporary one with the include list you type yourself.
The same rule applies in the other direction. Do not send your project to a classmate to “save them the setup.” Send the five-line note. Let them record their own session with their own seed login.
Worked case: a temporary project you can throw away
Quit Burp if it is open. Start it and choose the temporary project. Set the scope include for the lab origin. Browse one invoice as Avery. Quit Burp. Start it again with a new temporary project and confirm the history is empty. That empty table is the proof that yesterday’s cookie is not sitting in a file you forgot.
If you instead need the history for the mapping walkthrough, save a disk project in the lab folder, add the gitignore lines if that folder is a repository, and write the file path in the note. When the walkthrough note is finished and the lab data has been reset, delete the project file and confirm it is gone. The app reset and the file deletion are two different chores.
Diagram
Memory project or disk project
- Choose at startup
Temporary project keeps the work in memory. A disk project writes a file as you go.
- What is inside
Both hold requests and responses. The disk file still holds them tomorrow.
- Where it goes
The lab folder is the place for a file you mean to keep. A home directory full of old projects is not.
- When you are done
Close the window. Delete the disk file when the note is written and the brief says to discard the evidence.
Where the history lives after you quit
Startup. Disk project, default folder, name you will not remember.
Contents. Avery’s cookie and every response, still valid until the lab resets.
Later. The file gets copied into a backup or a git repo.
Startup. Temporary, or a named file inside the lab folder.
Contents. The same secrets, with a location written in the note.
Later. The gitignore entry keeps *.burp out of the lab repo. You delete the file when the brief says to.
# in the lab folder’s .gitignore *.burp *.burp-project # note at the top of today’s write-up Project: temporary or Project: lab-folder/harbor-ledger-lab.burp Delete after: the note is filed and the lab is reset
Check yourself
1. You are doing a first look at Harbor Ledger and you will write your notes in a text file today. Which project fits?
2. Why does the lab repo ignore *.burp?
3. You open a project and the scope include lists a hostname that is not 127.0.0.1. What do you do first?