Text editor

The text editor is used by the HTTP message editor for displaying requests and responses in raw form, and elsewhere within Burp for displaying plain text content.

Syntax analysis

Syntax in HTTP requests and responses is automatically colorized to highlight interesting items, such as parameters in requests and HTML elements in responses. JavaScript, JSON, and CSS content is also fully colorized. You can configure this behavior, and adjust the font, in message display options.

When syntax colorizing is enabled, the editor also displays mouse-over popups showing the decoded values of syntax items where appropriate. For HTTP requests, the popups perform URL-decoding, and for responses they perform HTML-decoding.

Pretty printing

The editor currently supports pretty printing of the following text formats:

• JSON
• XML
• HTML
• CSS
• JavaScript

This greatly improves the readability of data, markup, and code in HTTP messages by displaying them with standardized indentation and line breaks. In editable messages, such as in Burp Repeater, supported text formats will be dynamically prettified as you type wherever possible. Otherwise, the text will be prettified when you send the request.

By default, pretty printing is enabled for all messages in which Burp detects a supported text format. You can also manually toggle it on and off by clicking the "Pretty" button at the bottom of the editor.

If you would prefer not to use pretty printing by default, you can disable this setting under "User options" > "Display" > "HTTP Message Display".

Non-printing characters

By default, non-printing characters in HTTP requests and responses are hidden. However, you can use the "\n" button at the bottom of the editor to toggle whether these characters are rendered as small "lozenges". This is supported for any bytes with a hexadecimal value lower than 20, which includes tabs, line feeds, carriage returns, and null bytes.

This feature is beneficial for many use cases, for example:

• Spotting subtle differences between byte values in responses
• Experimenting with HTTP request smuggling vulnerabilities
• Studying line endings to identify potential HTTP header injection vulnerabilities
• Observing how null-byte injections are handled by the server

You can also edit the byte values from the "Hex" view.

Text editor hotkeys

The text editor supports hotkeys for various common actions. These can be configured in the hotkeys options, and the default hotkeys relevant to the text editor are as follows:

• Ctrl + A, select all
• Ctrl + X, cut selected text
• Ctrl + C, copy selected text
• Ctrl + V, paste
• Ctrl + S, find and highlight the selected text throughout the message
• Ctrl + Z, undo last edit
• Ctrl + Y, redo last undone edit
• Ctrl + U, URL-encode selected text (hold down Shift to decode)
• Ctrl + H, HTML-encode selected text (hold down Shift to decode)
• Ctrl + B, Base64-encode selected text (hold down Shift to decode)
• Ctrl + left, move to previous word
• Ctrl + right, move to next word
• Ctrl + up, move to previous paragraph
• Ctrl + down, move to next paragraph
• Ctrl + home, go to start of message
• Ctrl + end, go to end of message
• Ctrl + backspace, delete previous word
• Ctrl + del, delete next word

Quick search

At the bottom of the text editor is a search bar that can be used to quickly find expressions within the displayed text. As you type into the search box, the editor will automatically highlight matching items in the text. The "<" and ">" buttons can be used to move the selection to the previous or next match. The "+" button displays the following options:

• Case sensitive - This specifies whether the search is case sensitive or insensitive.
• Regex - This specifies whether the search term is a regular expression or a literal string.
• Auto-scroll to match when text changes - This specifies whether the text editor should automatically scroll to the first highlighted match when new text is displayed. This is useful, for example, when stepping through items in the Proxy history looking for a particular expression in responses. If this option is selected, then when you select a new item, the display will automatically scroll to the first search match.

Note that in addition to search highlights, some Burp tools apply their own highlights to requests and responses. For example, Burp Scanner highlights relevant parts of HTTP messages in its issue advisories. If you are not using the search function, you can use the "<" and ">" to move the selection between the tool-generated highlights.