> For the complete documentation index, see [llms.txt](https://recondock.gitbook.io/recondock/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://recondock.gitbook.io/recondock/burp/match-and-replace.md).
# Match & Replace
Useful Match and Replace BurpSuite Rules
## Finding hidden buttons, forms, and other UI elements
Many websites contain hidden buttons, forms, and other UI elements like
```html
```
* Show Hidden UI (1)
[](https://user-images.githubusercontent.com/36522826/166728753-b5b04276-fdf0-4102-bfee-7ac8fcd96cd4.png)
* Show Hidden UI (2)
[](https://user-images.githubusercontent.com/36522826/166728896-5fb0c698-50bb-4213-b227-6389afaf3854.png)
* Change disable to enable
[](https://user-images.githubusercontent.com/36522826/166729298-56e7272c-86c3-4f08-b712-606568a0367f.png)
## Changing `false` to `true`
Sometimes we can get hidden features by changing from `false` to `true`. The example:
* Changing role from normal user to admin
[](https://user-images.githubusercontent.com/36522826/166739661-a6e54638-0fa1-464e-b765-4d52b7a223f7.png)
* Make email verified
[](https://user-images.githubusercontent.com/36522826/166739292-7bf7bd71-3d7b-4ba0-91e2-97b679c41a83.png)
## Bypass WAF
Bypassing WAF by adding some headers
* Adding `X-Forwarded-Host: 127.0.0.1`
[](https://user-images.githubusercontent.com/36522826/166742712-f3208448-ec62-424f-98ac-db3aecb1326b.png)
> Create another rule but change the header to:
```
X-Forwarded-Port: 127.0.0.1
X-Forwarded-By: 127.0.0.1
X-Forwarded-Scheme: 127.0.0.1
X-Frame-Options: Allow
X-Forwarded-For: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Cluster-Client-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
Client-IP: 127.0.0.1
Origin: null
Origin: Domain.attacker.com
```
## Finding IDOR
By changing original user UUID to another UUID
[](https://user-images.githubusercontent.com/36522826/166742159-f740ec61-cb94-4ee7-bacf-7ed5b00e26bb.png)
> Create another rule but change the `type` to "Request First Line"
## Finding XSS
By adding some XSS payload into the request
* Finding XSS on `User-Agent`
[](https://user-images.githubusercontent.com/36522826/166749425-b9accf44-a606-473d-94c6-8e9562e02c07.png)
* Finding XSS on `Referer`
[](https://user-images.githubusercontent.com/36522826/166749753-d68eea0a-e290-4658-a2f1-cf66fcd89342.png)
* Auto replace user input with XSS payload
[](https://user-images.githubusercontent.com/36522826/166752610-9d21d86e-49e5-4e8f-86bc-a9134350d46d.png)
> So by just inputting the words `xss_payload` on the website it will be immediately replaced with `">` Change the XSS payload as you want
## MISC
Some random match and replace rules
* Finding [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q)
[](https://user-images.githubusercontent.com/36522826/166748175-6782ce51-b10f-4b1d-b8a3-610ef142d567.png)
> Create some another rules to look for them in headers, parameters and more. Because log4j can be found anywhere
* Help companies to identify your traffic and separate them from malicious traffic by adding a custom header
[](https://user-images.githubusercontent.com/36522826/166796789-e184716f-00a3-428d-9323-bcd985556798.png)
References:
*
*
*
*
*
*