HackBlue

Tools · Web testing tools · 24 / 27

A Burp history status is not the length

Status is the HTTP code on that row. Length is the size column. Write both, and do not copy 200 into the length.

12 min read · practice only with authorization

Status is the code on that history row

In Burp HTTP history, the status column is the HTTP status of that response. For the lab invoice fetch it is often 200. That number means the code. It does not mean the body was 200 bytes, and it does not describe a different row.

This page reads a row you already captured against http://127.0.0.1:3000. It does not edit the request and does not send a new one.

Length is the other column

The length column is the size Burp stored for that same response. It can be 248 while the status is 200. Those are two facts on one row. Putting 200 in the size slot claims a length the column did not show.

If the screenshot cut the length off, write that the length was not in the paste. Do not borrow the status, and do not borrow the length from the HTML document row.

How the row goes into the note

Write the method, the path, the status, and the length, each with its name. A sentence about the code uses status. A sentence about size uses length. Harbor Ledger’s invoice page and its API call stay two rows if both were captured.

Worked case: 200 copied into the length

Open Harbor Ledger at http://127.0.0.1:3000/invoices/1042 with the lab browser through Burp. In HTTP history, select GET /api/invoices/1042. Read the status and the length as two columns. A draft that says the body length is 200 has swapped them.

The note quotes the status and the length that are actually on the row. If you use 248 below, replace it with the number your column shows. The code stays the status. No request is modified.

Snippet
host: 127.0.0.1:3000
method: GET
path: /api/invoices/1042
status: 200
length: the size column, not 200
write: code and size
not: length 200

Diagram

Two columns on one Harbor Ledger row

  1. Row

    GET /api/invoices/1042 in HTTP history, host 127.0.0.1:3000.

  2. Status

    The HTTP code, such as 200. It is not a size.

  3. Length

    The size column for that response. It is a different number.

  4. Note

    Write both. A cropped length stays missing.

The code and the size answer different questions

Status

Is. The HTTP code on this row

200. That code, for this invoice fetch

Is not. The length in bytes

Length

Is. The size column

248. Whatever number that column printed

Missing. Say the length was not in the paste

Check yourself

1. A history row for GET /api/invoices/1042 shows status 200 and length 248. What is 200?

2. Which number is the length?

3. The length column was cropped out of the screenshot. What do you write for the size?