the-web-application-hackers-handbook

Chapter 14 n Automating Customized Attacks 609
The configuration needed to apply Burp’s session handling functionality to
the features of real-world applications is often complex, and mistakes are easily
made. Burp provides a tracer function for troubleshooting the session handling
configuration. This function shows you all of the steps performed when Burp
applies session handling rules to a request, allowing you to see exactly how
requests are being updated and issued, and identify whether your configuration
is working in the way that you intended. The session handling tracer is
shown in Figure 14-16.
Figure 14-16: Burp’s session handling tracer, which lets you monitor and debug your
session handling rules
Having configured and tested the rules and macros that you need to work
with the application you are targeting, you can continue your manual and automated
testing in the normal way, just as if the obstacles to testing did not exist.