Burp Suite User Forum

Java Deserialization

Sharon | Last updated: May 20, 2020 03:24AM UTC

Hello, I couldn't get burp to work with java applets for some reason, I've read all the articles related to it, Maybe I'm wrong in one of my steps, I run this: java -classpath burpsuite_free_v1.6.32.jar;burpjdser.jar;xstream-1.4.2.jar;C:\jars/* burp.StartBurp I've loaded "BurpJDSer-ng" to the extensions successfully Then tried to browse through the application but I get an error: Something went wrong, did you change the body in a bad way? java.lang.ClassNotFoundException: com.mer.util.proxy.InvocationResult at java.net.URLClassLoader.findClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Unknown Source) at burp.CustomLoaderObjectInputStream.resolveClass(CustomLoaderObjectInputStream.java:30) at java.io.ObjectInputStream.readNonProxyDesc(Unknown Source) at java.io.ObjectInputStream.readClassDesc(Unknown Source) at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source) at java.io.ObjectInputStream.readObject0(Unknown Source) at java.io.ObjectInputStream.readObject(Unknown Source) at java.io.ObjectInputStream.readObject(Unknown Source) at burp.BurpExtender$SerializedJavaInputTab.setMessage(BurpExtender.java:169) at burp.gh.b(Unknown Source) at burp.o8d.a(Unknown Source) at burp.o8d.a(Unknown Source) at burp.ig.stateChanged(Unknown Source) at javax.swing.JTabbedPane.fireStateChanged(Unknown Source) at javax.swing.JTabbedPane$ModelListener.stateChanged(Unknown Source) at javax.swing.DefaultSingleSelectionModel.fireStateChanged(Unknown Source) at javax.swing.DefaultSingleSelectionModel.setSelectedIndex(Unknown Source) at javax.swing.JTabbedPane.setSelectedIndexImpl(Unknown Source) at javax.swing.JTabbedPane.setSelectedIndex(Unknown Source) at javax.swing.plaf.basic.BasicTabbedPaneUI$Handler.mousePressed(Unknown Source) at javax.swing.plaf.synth.SynthTabbedPaneUI$1.mousePressed(Unknown Source) at java.awt.Component.processMouseEvent(Unknown Source) at javax.swing.JComponent.processMouseEvent(Unknown Source) at java.awt.Component.processEvent(Unknown Source) at java.awt.Container.processEvent(Unknown Source) at java.awt.Component.dispatchEventImpl(Unknown Source) at java.awt.Container.dispatchEventImpl(Unknown Source) at java.awt.Component.dispatchEvent(Unknown Source) at burp.n8d.a(Unknown Source) at burp.n8d.a(Unknown Source) at burp.i5b.mousePressed(Unknown Source) at java.awt.AWTEventMulticaster.mousePressed(Unknown Source) at java.awt.Component.processMouseEvent(Unknown Source) at javax.swing.JComponent.processMouseEvent(Unknown Source) at java.awt.Component.processEvent(Unknown Source) at java.awt.Container.processEvent(Unknown Source) at java.awt.Component.dispatchEventImpl(Unknown Source) at java.awt.Container.dispatchEventImpl(Unknown Source) at java.awt.Component.dispatchEvent(Unknown Source) at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source) at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source) at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source) at java.awt.Container.dispatchEventImpl(Unknown Source) at java.awt.Window.dispatchEventImpl(Unknown Source) at java.awt.Component.dispatchEvent(Unknown Source) at java.awt.EventQueue.dispatchEventImpl(Unknown Source) at java.awt.EventQueue.access$500(Unknown Source) at java.awt.EventQueue$3.run(Unknown Source) at java.awt.EventQueue$3.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source) at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source) at java.awt.EventQueue$4.run(Unknown Source) at java.awt.EventQueue$4.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source) at java.awt.EventQueue.dispatchEvent(Unknown Source) at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source) at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source) at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source) at java.awt.EventDispatchThread.pumpEvents(Unknown Source) at java.awt.EventDispatchThread.pumpEvents(Unknown Source) at java.awt.EventDispatchThread.run(Unknown Source)

Ben, PortSwigger Agent | Last updated: May 20, 2020 01:35PM UTC

Hi Sharon, Once we have issued a release we then do not change anything to it. Any additional functionality or bug fixes are placed in future releases. The BurpJDSer extension that you are using is also written by a third party so we do not have any control over its functionality. In addition to this, both the Burp version and extension that you are using are quite old (that particular version of Burp was released 5 years ago, the extension does not appear to have been updated in 7 years) so it is possible that the author of the extension has not updated to work with the version of Burp that you are trying to use. We would recommend using an up to date version of Burp and then checking to see if any of the deserialization extensions (hosted in our BApp store) work in the manner that you require.

You need to Log in to post a reply. Or register here, for free.