Intercepting JavaScript fetch() (promisse)

Hi guys and girls,

few days ago I tried to test a new webapp I made. I've used the now browser-native implementation of fetch() for AJAX type of requests.

Tried to intercept it with Burp and Foxy Proxy => Nothin
Tried to intercept it with Burp and Firefox Network Settings => Nothin
Tried to curl the target address => Nothin

I mean the Browser doesn't even show the Burp response, nor a certificate error. Yeah I looked into dev tools

All requests are over https and server-side there's a WAF, Content Security Policies, Domain Origin checks in the code and whatnot. At this point I got not the slightest idea where it could be caught, logs don't show anything special.

Please hit me with some ideas.

Sign In to comment.