Search Forum – PortSwigger

NET::ERR_CERT_VALIDITY_TOO_LONG

Linux Certificate : Android Device 7.0 (Nougat) Issue ---------------------------------------- NET

NET::ERR_CERT_WEAK_KEY

connection with Burp Proxy and shows the error "Your connection is insecure" with the following description: NET

.Net Framework

My Support team needs to upgrade .Net Framework and want to know if 4.8 .Net framework is supported?

Hi Kevin, Can you clarify what you are using the .NET framework for in relation to Burp?

NET::ERR_CERT_AUTHORITY_INVALID Help

NET::ERR_CERT_AUTHORITY_INVALID Help

.NET plugins support

Would be great giving .net support to develop burpsuite plugins

But there are existing technologies that can let you bridge between .NET and Java code, for example:

I am trying to install the infiltrator on web server that has .net 4 framework. … When installing it keeps saying that it cannot install the .net 3.5. … When building the infiltrator it states that .net 2.0 or later is supported.

Infiltrator (a few years ago now) we did carry out some extensive testing on applications that were running .NET

Getting net::ERR_HTTP2_PROTOCOL_ERROR after doing latest update of burp

Hi, I updated the Burp to its latest update a couple of days earlier, and ever since burp's preconfigured browser is not able to load any URL in it, giving the blank screen. Initially, it was giving the error of security...

Burp Suite Chrome Cert Error: Error net::ERR_CERT_REVOKED

Linux Mint 19.1 Chrome Version 73.0.3683.86 Burp Suite Pro v2.0.18 Beta And I'm getting a bunch of net

So most sites seem to work, but https://cdnjs.cloudflare.com returns the 'Error net::ERR_CERT_REVOKED

Burp hangs when using http request smuggler

Smuggler false Python Burp Importer true Java Taborator true Java JSON Web Token Attacker true Java .NET

Intruder and there has been a bug reported for extension that causes the UI to lock when you have the .NET … extension loaded: https://github.com/PortSwigger/turbo-intruder/issues/55 Are you able to remove the .NET

Removed .NET Beautifier extension and it's working now Thanks

Assistance With Private Collaborator Setup

.*********.net. … .*********.net could not be resolved to an IP address. … digitalocean.com ns2.digitalocean.com ns3.digitalocean.com DigitalOcean Records: A ****.net … .********.net points to ns1.collaborator.*******.net A ns1.collaborator.******.net directs to … 201.81.**.** (Droplet VPS) Collaborator Config File: { "serverDomain" : "collaborator.***.net"

.********.net polling location : collaborator.*******.net:9443

.****.net) are delegated to your private Collaborator server’s DNS (ns1.collaborator.****.net) You will … also need to configure glue records to associate ns1.collaborator.****.net with the IP of your collaborator

No such file or directory error - ruby deserialization

module Gem class Requirement def marshal_dump [@requirements] end end end wa1 = Net … RequestSet.allocate rs.instance_variable_set('@sets', wa1) rs.instance_variable_set('@git_set', "ls") wa2 = Net … :Entry.allocate i.instance_variable_set('@read', 0) i.instance_variable_set('@header', "aaa") n = Net

wa1 = Net … wa2 = Net … n = Net

Error in JRuby extension in newest Burp versions

JRuby version is 9.3.11.0 The error is raised when 'net/http' library is used. … burp.IBurpExtender' java_import 'burp.IExtensionStateListener' java_import 'burp.IContextMenuFactory' require 'net … JRUBY_VERSION uri = URI.parse("https://google.com") use_ssl = uri.scheme == 'https' http = Net … ::HTTP.start(uri.host, uri.port, use_ssl: use_ssl ) request = Net::HTTP::Get.new uri response … = http.request request # Net::HTTPResponse object body = response.body http.finish end

jruby SSLSocket error

/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:800:in `connect'", "org/jruby/ext/timeout/Timeout.java: … /META-INF/jruby.home/lib/ruby/1.9/net/http.rb:800:in `connect'", "/Users/aaron/Downloads/jruby-complete … /META-INF/jruby.home/lib/ruby/1.9/net/http.rb:756:in `do_start'", "/Users/aaron/Downloads/jruby-complete … /META-INF/jruby.home/lib/ruby/1.9/net/http.rb:745:in `start'", "/Users/aaron/Downloads/jruby-complete … /META-INF/jruby.home/lib/ruby/1.9/net/http.rb:1293:in `request'", "<script>:483:in `create_dradis_issue

The suggested solution of using the Burp API to make the request, as opposed to Ruby's Net::HTTP, worked

Instrumented by Infiltrator Queries

Is there a way to specify .net version as i wrote my application in .net 4/4.5 while infiltrator tries … to use .net 2.0 2. … there a way to tell infiltrator to hook into selected dll as i dont want infiltrator to hook into .net

Embedded Browser

Hi, I use the embedded browser to access any site, it returns "Failed to load resource: net::ERR_CONTENT_LENGTH_MISMATCH

when I try to intercept the request using the embedded browser, it returns "Failed to load resource: net

The errors that are shown in the dev tools console are: GET http://localhost:3000/main.js net::ERR_CONTENT_LENGTH_MISMATCH … 200 (OK) GET http://localhost:3000/styles.css net::ERR_CONTENT_LENGTH_MISMATCH 200 (OK) GET http:/ … /localhost:3000/vendor.js net::ERR_CONTENT_LENGTH_MISMATCH 200 (OK) When I refresh the page, some

Exploiting Ruby deserialization using a documented gadget chain

Gem class Requirement def marshal_dump [@requirements] end end end wa1 = Net … RequestSet.allocate rs.instance_variable_set('@sets', wa1) rs.instance_variable_set('@git_set', "id") wa2 = Net … Entry.allocate i.instance_variable_set('@read', 0) i.instance_variable_set('@header', "aaa") n = Net

Gem class Requirement def marshal_dump [@requirements] end end end wa1 = Net … rs.instance_variable_set('@sets', wa1) rs.instance_variable_set('@git_set', "rm /home/carlos/morale.txt") wa2 = Net … Entry.allocate i.instance_variable_set('@read', 0) i.instance_variable_set('@header', "aaa") n = Net

trying to compile the script with Ruby 3.1, I got an error message complaining about the line "wa1 = Net

java.net.SocketException: Connection reset

http://net-informations.com/java/net/socket.htm

Advanced Target Scope - Load File

.*\.example\.com\/* test\.net\/path\/here\/* www\.test\.net\/* -----------

Exploiting Ruby deserialization using a documented gadget chain

module Gem class Requirement def marshal_dump [@requirements] end end end wa1 = Net … RequestSet.allocate rs.instance_variable_set('@sets', wa1) rs.instance_variable_set('@git_set', "ls") wa2 = Net … :Entry.allocate i.instance_variable_set('@read', 0) i.instance_variable_set('@header', "aaa") n = Net

Static and Dynamic scan of .NET MVC web application coding in development environment

Hi, I am planning to buy two licenses of Burp Professional. Does Burp professional license includes all the modules/functionalities including static/dynamic scanning of developers actual coding. If not what should I need to...

burp-gets-new-javascript-analysis-capabilities It's also worth noting that our Infiltrator tool performs IAST testing of .NET

Not tracking extension properly

But if select certain extensions like .NET Beautifier, under the description the Install button is greyed

Note that the .NET Beautifier extension requires Jython, and so the Install button will be greyed out

Support for Kerberos Auth.

I need to test a .NET app which uses Kerberos.

Viewstate parser

I have created an extension for the .NET viewState.

2.1.04 scanner stalling on pretty much every test

Extension type: Java JSON Decoder Extension type: Python .NET

machine is not connected to the internet, that's not going to help much is it ;-) If I connect it to the net … I'll detach the machine from the test network now and plug it into the net and do the upgrade, that might

burp_infiltrator_java

support: - Java, Groovy, Scala, or other JVM languages (JRE versions 1.4 - 1.8) - C#, VB, or other .NET … languages (.NET versions 2.0 to 4.5)

Facing issues while running the Burp Infiltrator

written in: - Java, Groovy, Scala, or other JVM languages (JRE versions 1.4 - 1.8) - C#, VB, or other .NET … languages (.NET versions 2.0 to 4.5) If it encounters a class/file that is unsupported, it will skip

Hide viewstate

There is an extension in the BApp Store called .NET Beautifier which performs this function.

asp .net web form application, with forms authentication, how do I pass the login credentials

trying to scan a secure page on our application , but authentication hits and login page gets loaded

Newest Burp Suite Pro Update Issue

EXE4J_JAVA_HOME to point to an installed 64-bit JDK or JRE or download a JRE from httpx://adoptium[.]net … Also why adoptium[.]net? Wouldn't one want to go to Java or Oracle? Thanks! Best, Russ

IAST

feature: - Java, Groovy, Scala, or other JVM languages (JRE versions 1.4 - 1.8) - C#, VB, or other .NET … languages (.NET versions 2.0 to 4.5) Let us know if you need anything further.

Cannot use Collaborator in auditing

https://forum.portswigger.net/thread/is-burpcollaborator-net-down-569a80e7

Lab: Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria

The solution for this lab has an incorrect reference to a .com site instead of the .net site. 11. … your-exploit-server-id.web-security-academy.com Anyone who copy/paste's this step incorrectly instead of using the correct ".net

Allowing all hosts through SSL passthrough except one?

portswigger-labs\.net$) ^443$ when testing with portswigger-labs.net Could you give that a go with

portswigger-labs\.net$) into the 'Host or IP range' and ^443$ into the 'Port'?

Web Site scanning

Hello, We are trying to scan an Angular/.NET Core application with Burp.

BurpHttpMock - faulty behavior only on installed macos version

message) https://github.com/LogicalTrust/BurpHttpMock/blob/9161d59c0a226d6882d29cb11025da25af30f4d6/src/net … it https://github.com/LogicalTrust/BurpHttpMock/blob/9161d59c0a226d6882d29cb11025da25af30f4d6/src/net … IProxyListener" https://github.com/LogicalTrust/BurpHttpMock/blob/9161d59c0a226d6882d29cb11025da25af30f4d6/src/net

Burp Infiltrator for PHP

We don't have current plans for this though, largely because the Java and .Net Infiltrators have relatively

Network is unreachable when connected to the internet via Apple USB phone. Burp proxy works normal when using normal router

yes i am also facing same problem , i think burp requires static net (modem or fiber connection), on

Crawl Website completely

Hi, I have Burp Suite Professional v2022.9.6 I am trying to crawl and audit my website (using .Net

ASP ViewState does not show up

In the meantime, you could attempt to edit the code for .NET Beautifier: https://portswigger.net/bappstore

Have you considered using .NET Beautifier as a workaround?

TLSv1.3 not accepted by server preferences

I think it runs on .Net which doesn't have TLS 1.3 support yet.

how the extensions work on a lan network?

portswigger,net i can acces, oastify.com i cant get the warning: security risk blocked for your protection

Website doesnt load when proxying through burp

doesn't seem to be anything that would cause issues on that page so if you can email support@portswigger/net

Burp Collaborator

(I've tried multiple threads on the net as well as portswigger's guide but nothing fit to my needs) any

Advanced Scope Control does not follow correct regex syntax

This behaviour will cause the following valid regex pattern to fail: `[a-z]*\.portswigger\.net` Should … noticed the following invalid regex syntax was actually matching all subdomains: `^*\.portswigger\.net

Burp Infiltrator

Which platform are you patching (Java or .NET)? 2.

Burp 2020.9.1 crashes when sending certain characters in repeater

But, this bug seems to be triggered just if the ".NET Beautifier" extension in installed.

I tried on version 2021.2.1 of BurpSuite on Windows with ".NET Beautifier" extension installed and I

the bug is still present (in version v2021.2.1 for Windows and Linux) only when I have enabled both ".NET

Cert validity too long

I can see now that the certificate was issued in 2014, however I still get the NET::ERR_CERT_VALIDITY_TOO_LONG

Can confirm that I regenerated CA cert, imported on phone (Chrome / Android 7), and still receive NET

Launch burpsuite_pro.zar from command line C#

You should be able to use the JSON parser in .Net to process it.

Can not using burp when application added Clouldflare

Learn more NET::ERR_CERT_AUTHORITY_INVALID Help improve Safe Browsing by sending some system information

Is there a way to suppress ASP.NET_SessionId cookie tests?

It is a Microsoft .NET cookie out of their control.

Feature Request: Extension Profiles

If it is possible, it would be great to load a profile of extensions for .NET testing or a different

Burp Suite CA Certificate Not Trusted

tried to install the CA Certificate but whenever I load a https:// URL, I get the following error: NET

Burp consumes all RAM

Extensions: .NET Beautifier Active Scan++ Detect Dynamic JS Logger++

Burp suite 1.7.37 - create burp certificate less than 39 month

The problem is that when i enter any website with ssl i encounter the follow error: NET::ERR_CERT_VALIDITY_TOO_LONG

Scan for trace.axd

below in the Burp Vulnerability Knowledge Base below: https://portswigger.net/kb/issues/00100280_asp-net-tracing-enabled

ViewState Parser not parsing

Similarly, .NET Beautifier doesn't register the cookie and make it's prettification happen.

Make SSL work with Chrome (yes, I read the installation procs)

Still not working, classical NET::ERR_CERT_COMMON_NAME_INVALID (screencap: https://i.imgur.com/fjqf3nRl.png

FireFox wprks just fine but on Chromium I get below error with message "Your connection is not private" NET

[Burp Pro] Programmatically create Responses

But i do not want these requests to be actually sent over the net. … analysis of the requests and responses is handled by burp, the actual sending of the requests over the net

Division by zero while loading a saved project

http://net-informations.com/java/err/ari.htm

Not able to locate the file

Browser showing this error NET ERR CERT AUTHORITY INVALID. I want to make it work on Chrome?

HTTP2 support

HTTP/2.0 is now being replaced for HTTP/3 (https://http3.net) We have seen both HTTP/2 and HTTP/3

Burp Infiltrator - Feedback if set up correctly

Dear Portswigger, I am trying to use Burp Infiltrator on a .NET application.

Getting a Certificate not accepted message from call to GraphQL in Burp Suite Enterprise.

view=net-5.0

Enterprise edition and SPA pages

We use .net and angularjs for the SPA, will Burp handle this?

Burp not responding

the open button at first it does not respond, and then after a few minutes it gives me this error - net

DNS request from a graphic

The reference is on an .Net Master Page (where most our graphics are referenced.)

Web pages don't load through proxy, is this normal?

Thanks for the help it worked and you can navigate the net while intercept is on but , you can't see

Android Mobile Application testing CA Certification issue

Chrome Browser Open Chrome in Incognito Mode Expired SSL Certificates Update Chrome Browser http://net-informations.com

java.util.ConcurrentModificationException while automating

entry.getKey().equals("B")) { newMap.put(entry.getKey(), entry.getValue()); } } http://net-informations.com

ASVS v4 Lv3 Coverage

We map to CWE’s were applicable, e.g. https://portswigger.net/kb/issues/00100280_asp-net-tracing-enabled

Error Agent for new Scan

<date>.log And: ### The error may exist in net/portswigger/enterprise/common/repository/mybatis

2020.4.1 Missing ViewState Tab in Request

why this was removed, it was incredibly useful and the climate of awareness surrounding issues like .NET

No solution seems to work on this lab

img src=x onerror=print(1)>'"></iframe> I've tried both with a slash and without a slash between .net

Scanner: java.net.SocketException: Connection reset

http://net-informations.com/java/net/socket.htm

Attempting to auto-select SSL parameters for..

Learn more NET::ERR_CERT_AUTHORITY_INVALID Some help is really appreciated .... Thank you ..

Request vulnerable to Cross-site Request Forgery (CSRF)

Hi Team, I have a couple of .net MVC application and one application loads into other using IFrames

An issue in payload for the OOB SQL injection detection

Hi, In my recent penetration testing I discovered a few instances of Blind SQL Injection in a .NET

Use NTLMv2 platform authentication with the Scanner?

Trying to run an active scan on a ASP .NET site using NTLMv2 has stopped working, but I can use the repeater

call graphql api

Hi dear, I wanted to call graphql api, but I have a problem in my code, I use .net 6.0.

cookies session collaborator

*/</script></p> How fetch cookies using collaborator ...line .net

Scanner is crawling and auditing out of scope items.

with any letter except my domain but I still catch google cloud resources, ad tracker links etc in my net

Burp Suite as Invisible Proxy has trouble with Client Hello containing server_name extension

Here’s a link for Java which also cites the same RFC: https://docs.oracle.com/javase/8/docs/api/javax/net

Android Chrome 99+ "Certificate Transparency" feature blocks burp certificate

obviously not be provided for the burp interception CA cert and Chrome 100.0.4896.127 on Android says: "NET

Chrome gives the error "NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED". Firefox works fine.

No traffic recorded for an app on localhost in Chrome with FoxyProxy Standard

Chrome documentation that might be useful: - https://chromium.googlesource.com/chromium/src/+/HEAD/net

Burp Infiltrator for PHP

softwares have IAST tools like Infiltrator (AcuSensor, WebInspect Sensor, etc) and many support only .net

This site can't be reached

https://net-informations.com/q/mis/reached.html

Lab: CORS vulnerability with basic origin reflection not working

Failed to load resource: net::ERR_FAILED: 0a3200aa03119839807b49f700e500ee.web-security-academy.net/accountDetails

How do I fix BurpSuite Error: The client failed to negotiate a SSL connection to ... Received fatal failed alert: certificate_unknown

NET::ERR_CERT_AUTHORITY_INVALID" "In addition to the above, if you view the Trusted Certificates -

Jython - ImportError: No module named expatreader

http://net-informations.com/ql/pya/modules.html

Lab: SameSite Lax bypass via cookie refresh

change-email" method="POST"> <input type="hidden" name="email" value="wiener1@normal-user.net

ca certificate

Learn more NET::ERR_CERT_AUTHORITY_INVALID i am able to access http://burp/ using that i have click

watseka.com AVAILABLE watseka.net AVAILABLE Other ----- 66.net

Cannot solve lab "CSRF where token is duplicated in cookie"

change-email" method="POST"> <input type="hidden" name="email" value="wiener@normal-user.net

How to do POC for PRSSI vulnerability

https://soroush.secproject.com/blog/2015/02/non-root-relative-path-overwrite-rpo-in-iis-and-net-applications

Not able to access http://{Ip-Addr}:8080 remotely

Browser Cache Check your Security programs Restart your router Disable Proxy Settings http://net-informations.com

400 bad request no ssl sent in postman response

The solution for this problem is that procure a new certificate and upload the certificate https://net-informations.com

I am having a problem getting a GraphQL call to be processed by our Burp Suite Enterprise

The program is written in C# using the .Net Core 5.0 version.

android web browser error - your connection is not private

http://net-informations.com/q/mis/ssl.html

BSCP: Examity - Proctoring and other stuff

So I tried rent a VPS geographically close to the exam lab VM to improve the net lag and packet loss.

Connection Reset Issues - java.net.SocketException: Connection reset

http://net-informations.com/java/err/reset.htm

Could not find or load main class .awt.headless=true

occur this error is : File Extension Wrong package Invalid Classpath Wrong Class Name http://net-informations.com

ArrayIndexOutOfBoundsException

http://net-informations.com/java/cjava/default.htm

Lab: CSRF vulnerability with no defenses

change-email" method="POST"> <input type="hidden" name="email" value="wiener@exploited.net

Turbo Intruder ( Import error of a python library - requests module )

https://net-informations.com/python/err/imp.htm

How can I check if the Infiltrator works properly?

For example in the Acunetix .NET Acusensor I can send some kind of debug headers to the patched web application

IT DOESN'T WORK - Lab: Username enumeration via account lock

attack multiple times in multiple modes, looking at both solutions and other walktroughs found on the net

HTTPS/HSTS errors after certificate import

When navigating to google.com the browser shows this error: `NET::ERR_CERT_AUTHORITY_INVALID` The chrome

Android Emulator - ERR_SSL_PROTOCOL_ERROR

Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR If I remove Burp from the equation, and point

SSL Errors

javax.net.ssl.SSLException: Received fatal alert: handshake_failure (on android phone i got this error: net

Can't pass the "CSRF with broken Referer validation" lab even if my solution works

change-email" method="POST"> <input type="hidden" name="email" value="test2@exploit.net

Burp Not Loading, No Error Messages

--diagnostics Can you email the output from trying to start Burp at the CLI to support@portswigger/net

How to Map or generate Burp suite result with OWASP 10 and WASC (Web Application Security Consortium )

E.g. https://portswigger.net/kb/issues/00100280_asp-net-tracing-enabled makes note of CWE-10: ASP.NET

We know that,login authetication is must for crawling and scaning . So what are the different ways for authentication . for example we need to provide the just login details and base url then it will do the crawling and scanning and i also read about macr

It's not possible SQL injections in .dot net applications , As I executed the burp suit on an application

NET::ERR_CERT_VALIDITY_TOO_LONG

NET::ERR_CERT_WEAK_KEY

.Net Framework

net flix

NET::ERR_CERT_AUTHORITY_INVALID Help

.NET plugins support

Burp Infiltrator and .net 4

Getting net::ERR_HTTP2_PROTOCOL_ERROR after doing latest update of burp

Burp Suite Chrome Cert Error: Error net::ERR_CERT_REVOKED

Burp hangs when using http request smuggler

Assistance With Private Collaborator Setup

No such file or directory error - ruby deserialization

Error in JRuby extension in newest Burp versions

jruby SSLSocket error

Instrumented by Infiltrator Queries

Embedded Browser

Exploiting Ruby deserialization using a documented gadget chain

java.net.SocketException: Connection reset

Advanced Target Scope - Load File

Exploiting Ruby deserialization using a documented gadget chain

Static and Dynamic scan of .NET MVC web application coding in development environment

Not tracking extension properly

Support for Kerberos Auth.

Viewstate parser

2.1.04 scanner stalling on pretty much every test

burp_infiltrator_java

Facing issues while running the Burp Infiltrator

Hide viewstate

asp .net web form application, with forms authentication, how do I pass the login credentials

Newest Burp Suite Pro Update Issue

IAST

Cannot use Collaborator in auditing

Lab: Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria

Allowing all hosts through SSL passthrough except one?

Web Site scanning

BurpHttpMock - faulty behavior only on installed macos version

Burp Infiltrator for PHP

Network is unreachable when connected to the internet via Apple USB phone. Burp proxy works normal when using normal router

Crawl Website completely

ASP ViewState does not show up

TLSv1.3 not accepted by server preferences

how the extensions work on a lan network?

Website doesnt load when proxying through burp

Burp Collaborator

Advanced Scope Control does not follow correct regex syntax

Burp Infiltrator

Burp 2020.9.1 crashes when sending certain characters in repeater

Cert validity too long

Launch burpsuite_pro.zar from command line C#

Can not using burp when application added Clouldflare

Is there a way to suppress ASP.NET_SessionId cookie tests?

Feature Request: Extension Profiles

Burp Suite CA Certificate Not Trusted

Burp consumes all RAM

Burp suite 1.7.37 - create burp certificate less than 39 month

Scan for trace.axd

ViewState Parser not parsing

Make SSL work with Chrome (yes, I read the installation procs)

[Burp Pro] Programmatically create Responses

Division by zero while loading a saved project

Not able to locate the file

HTTP2 support

Burp Infiltrator - Feedback if set up correctly

Getting a Certificate not accepted message from call to GraphQL in Burp Suite Enterprise.

Enterprise edition and SPA pages

Burp not responding

DNS request from a graphic

Web pages don't load through proxy, is this normal?

Android Mobile Application testing CA Certification issue

java.util.ConcurrentModificationException while automating

ASVS v4 Lv3 Coverage

Error Agent for new Scan

2020.4.1 Missing ViewState Tab in Request

No solution seems to work on this lab

Scanner: java.net.SocketException: Connection reset

Attempting to auto-select SSL parameters for..

Request vulnerable to Cross-site Request Forgery (CSRF)

An issue in payload for the OOB SQL injection detection

Use NTLMv2 platform authentication with the Scanner?

call graphql api