Match and replace rules enable you to automatically replace parts of messages as they pass through the Proxy. You can configure and enable these in the Proxy > Match and replace tab for both HTTP and WebSocket messages. Burp executes enabled match and replace rules in turn for each message, making any applicable replacements.
The HTTP match and replace rules include various predefined rules which you can enable to assist with common tasks. These are disabled by default.
To only apply match and replace rules to items that are in the project scope, select Only apply to in-scope items. For more information on how to set a scope for your work, see Scope settings - Target scope.
You can Add, Edit and Remove rules, or reorder them using the Up and Down buttons.
Each match and replace rule specifies a literal string or regex pattern to match, and a string to replace it with. You can configure match and replace rules in two different ways:
On the Settings mode tab, you can apply a match and replace rule using the configuration options.
To add a new rule using Settings mode:
Specify the details of the match/replace rule:
Burp executes the enabled match and replace rules in turn for each message, and makes any applicable replacements.
You can also Edit and Remove rules, or reorder them using the Up and Down buttons.
On the Bambda mode tab, you can write Java-based Bambdas to apply HTTP match and replace rules.
Two objects of the Montoya API are available to help you write your Bambdas:
ProxyHttpRequestResponse
Utilities
The Bambda must return either the HttpRequest or HttpResponse object.
For advanced use cases, you can also access a subset of the MontoyaAPI functionality. This enables you to create more complex Bambdas.
Use the MontoyaAPI functionality carefully when creating match and replace Bambdas. While we've restricted access to known dangerous functionality, certain methods may still potentially impact Burp's performance or cause memory leaks.
To add a new rule using a Bambda:
The Bambda is added to the HTTP match and replace rules table and automatically enabled for the current project.
Using slow running or resource-intensive Bambdas can slow down Burp. Write your Bambda carefully to minimize performance implications.
In the example below, we'll create a Request Bambda that forces all HTTP requests to https://ginandjuice.shop and adds a User: Admin header.
return requestResponse.request()
.withService(HttpService.httpService("https://ginandjuice.shop"))
.withAddedHeader("User", "Admin")
.withUpdatedHeader("Host", "ginandjuice.shop");
In the example below, we'll create a Response Bambda that uses the MontoyaAPI functionality to send items to Organizer with the note "Cached response" when they meet the following criteria:
X-Cache header with a value of Hit.
In this example, our Bambda is:
if(requestResponse.response().headerValue("X-Cache").contains("Hit")) {
api().organizer().sendToOrganizer(HttpRequestResponse.httpRequestResponse(requestResponse.request(), requestResponse.response(), Annotations.annotations("Cached response")));
}
return requestResponse.response();
For information on how to load Bambdas, save your Bambda, or troubleshoot errors with your Bambda, see our Bambdas documentation.
When adding or editing a HTTP match and replace rule, you can test your rule using the built-in test function. This enables you to confirm that the string or regex pattern correctly matches and replaces the intended text.
To test a HTTP match and replace rule in the match/replace rule editor:
To restore the sample request or response, click .
You can use a regex pattern to match the text you want to replace. This enables you to match a variety of text inputs that follow a specific format, such as email addresses or IP addresses. It also enables you to match the underlying structure for content that changes dynamically.
You can use regex syntax to match multi-line regions of a message body. For example, if a response body contains only:
Now is the time for all good men
to come to the aid of the partythen using the regex:
Now.*thewill match:
Now is the time for all good men
to come to the aid of theIf you want to match only within a single line, you can modify the regex to:
Now[^\n]*thewhich will match:
Now is the
In a Match expression you can:
For example, to match a pair of opening and closing tags with no other tags between, you could use the regex:
<([^/]\w*)[^>]*>[^>]*?</\1[^>]*>You can reference groups in the replacement string by using a $ followed by the group index. For example, the following replacement string would include the name of the tag that matched the above regex:
Replaced: $1