Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

Method IBurpExtender#registerExtenderCallbacks is not called anymore in 2022.9.5

CITU | Last updated: Nov 14, 2022 01:48PM UTC

Dear support, I have a Burp extension using the old extension API. When I run my extension within 2021.10.2 everything is working fine but when run my extension using 2022.9.5 version then I see that the method IBurpExtender#registerExtenderCallbacks is not called. My extender class looks like: package burp; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; public class BurpExtender implements IBurpExtender { ....... Any help or hint is welcomed. thx, Adrian

Hannah, PortSwigger Agent | Last updated: Nov 14, 2022 02:18PM UTC

Hi Adrian Are you receiving any error messages when attempting to load your extension? If so, could you tell me what they are?

CITU | Last updated: Nov 14, 2022 07:28PM UTC

Hello Hannah, I don't receive any error but I have a few warning that I already had it before doing the update (using 2021.10.2 it also triggers this warnings): WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by burp.tl1 (file:/opt/burp/megaburp.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of burp.tl1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Most probably this is due to the fact that my extension is actually a SpringBoot application that starts burp by calling the Burp main: burp.StartBurp.main(args.getSourceArgs()); I added a breakpoint into my implementation of IBurpExtender#registerExtenderCallbacks and is never trigered. thx, Adrian

Hannah, PortSwigger Agent | Last updated: Nov 15, 2022 10:55AM UTC

Hi Adrian How are you currently loading your extension/BurpExtender class into Burp? Did you have it configured in the command-line startup options as a classpath?

CITU | Last updated: Nov 15, 2022 01:59PM UTC

Hello Hannah, The short answer is via reflection: The long answer: My application whith is called megaburp is a Spring boot app. When megaburp starts then it will start burp via a call to burp.StartBurp.main(args.getSourceArgs()) which will call (via reflection) the class burp.BurpExtender#registerExtenderCallbacks. Megaburp contains a class burp.BurpExtender that implements the IBurpExtender. This how it worked since version 1.7 when megaburp has been created. Something between 2021.10.2 and 2022.9.5 had change this behaviour. Now just for the record I add a stacktrace of the application starting until the call of the burp.BurpExtender#registerExtenderCallbacks method: registerExtenderCallbacks:31, BurpExtender (burp) invoke0:-1, NativeMethodAccessorImpl (jdk.internal.reflect) invoke:62, NativeMethodAccessorImpl (jdk.internal.reflect) invoke:43, DelegatingMethodAccessorImpl (jdk.internal.reflect) invoke:566, Method (java.lang.reflect) lambda$registerExtenderCallbacks$0:-1, dj6 (burp) run:-1, 1498110654 (burp.dj6$$Lambda$1131) call:515, Executors$RunnableAdapter (java.util.concurrent) run$$$capture:264, FutureTask (java.util.concurrent) run:-1, FutureTask (java.util.concurrent) - Async stack trace <init>:151, FutureTask (java.util.concurrent) newTaskFor:93, AbstractExecutorService (java.util.concurrent) submit:117, AbstractExecutorService (java.util.concurrent) a:-1, aoh (burp) a:-1, dj6 (burp) a:-1, cup (burp) r:-1, cup (burp) lambda$start$0:-1, gjq (burp) b:-1, fyd (burp) call:515, Executors$RunnableAdapter (java.util.concurrent) run$$$capture:264, FutureTask (java.util.concurrent) run:-1, FutureTask (java.util.concurrent) - Async stack trace <init>:151, FutureTask (java.util.concurrent) newTaskFor:93, AbstractExecutorService (java.util.concurrent) submit:117, AbstractExecutorService (java.util.concurrent) a:-1, aoh (burp) a:-1, fyd (burp) a:-1, gty (burp) b:-1, csa (burp) a:-1, csa (burp) a:-1, a5w (burp) i:-1, a5w (burp) main:-1, StartBurp (burp) <init>:97, BurpService (com.mypackage.megaburp.service) newInstance0:-2, NativeConstructorAccessorImpl (jdk.internal.reflect) ........some more Spring Boot.............. refreshContext:405, SpringApplication (org.springframework.boot) run:315, SpringApplication (org.springframework.boot) main:17, App (com.mypackage.megaburp)

Hannah, PortSwigger Agent | Last updated: Nov 15, 2022 04:49PM UTC

Hi Have you looked at adding the relevant "--add-opens" arguments to your launch command, in order to allow reflection? Does your extension load successfully into Burp separately from your Megaburp application?

CITU | Last updated: Nov 15, 2022 09:23PM UTC

Hi again Hannah, Thx (again) for your help, Now, my application is not using (Java9) modules so --add-opens is not really relevant in my case and same code, same JVM works with older version of Burp. About loading the extension from Burp UI; I tried to load it and I have the error:java.lang.Exception: Extension class is not a recognized type at burp.rni.v(Unknown Source) at burp.rni.<init>(Unknown Source Even if hte etension was never been meant to be loaded like this it suppose to wok because I have a package called burp and inside a class (called BurpExtender) that implements the IBurpExtender interface. thx, Adrian

Hannah, PortSwigger Agent | Last updated: Nov 17, 2022 10:19AM UTC

Hi Adrian You could try using the "--developer-extension-class-name" flag as part of your launch command. This is currently not available on the stable channel of Burp but is available on the Early Adopter channel. You can further check the details by launching Burp with the "--help" argument.

You need to Log in to post a reply. Or register here, for free.