The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Error in JRuby extension in newest Burp versions

Alex | Last updated: Nov 01, 2023 03:55PM UTC

Hello, I've started to get errors in JRuby extension starting from v10 of Burp Community Edition (MacOS M1). JRuby version is 9.3.11.0 The error is raised when 'net/http' library is used. The error is: java.lang.NoSuchMethodError: 'org.bouncycastle.asn1.DERIA5String org.bouncycastle.asn1.DERIA5String.getInstance(java.lang.Object)' There was no such error in Burp version 9.1 and earlier. However it's present in version 10.2.2 and newest. Can you point out the reason why this issue arises and how it can be resolved? Here is a sample Ruby code for extensions which triggers an error: require 'java' java_import 'burp.IBurpExtender' java_import 'burp.IExtensionStateListener' java_import 'burp.IContextMenuFactory' require 'net/http' class BurpExtender include IBurpExtender, IExtensionStateListener, IContextMenuFactory def registerExtenderCallbacks(callbacks) puts JRUBY_VERSION uri = URI.parse("https://google.com") use_ssl = uri.scheme == 'https' http = Net::HTTP.start(uri.host, uri.port, use_ssl: use_ssl ) request = Net::HTTP::Get.new uri response = http.request request # Net::HTTPResponse object body = response.body http.finish end end

Hannah, PortSwigger Agent | Last updated: Nov 02, 2023 03:44PM UTC

Hi It may be that due to some library version updates, this method is no longer available. Do you have the same issue using a Python or Java version of your extension? Overall, we would not recommend using networking libraries in extensions. Instead, we'd recommend using Burp's built-in networking capabilities (IBurpExtenderCallbacks.makeHttpRequest()). This means that configured rules in Burp are able to be applied to your outgoing requests. For example, if traffic needs to pass through an upstream proxy, the rule will automatically be applied.

Alex | Last updated: Nov 03, 2023 08:06PM UTC

Hi Hannah, Thank you for the response. I haven't checked Python or Java versions of the same code. I know about makeHttpRequest exists, but this is my personal small extension and I slightly prefer more Ruby built-in library. Maybe you have an idea what kind of burp library update may cause this?

Hannah, PortSwigger Agent | Last updated: Nov 06, 2023 10:39AM UTC