Response extraction rules - Port Swigger
Summary: PortSwigger's documentation describes response extraction rules in Burp, which define where in an HTTP response a varying item sits so it can be pulled out consistently across multiple responses. The rules are used to identify a custom session token in Sequencer, define an extract grep item in Intruder, and specify the location of a custom parameter value in a macro, with configuration set either by selecting the item in a sample response or manually via start and end points or a regular expression group.
What you should know: These extraction rules are what let Burp reliably pull a session token or parameter value out of responses that differ between requests, so a misconfigured rule can quietly break the token or parameter tracking a tester depends on.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026