Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Modify Executable in the Intercept Response Tab

Muralidharan | Last updated: Feb 16, 2020 05:45PM UTC

Hi Folks, I have the following test use case with Burp and i kindly request your insight to resolving this: 1. I need to showcase a proof that a windows client (target) doesnt perform signature validation on the client side for its updates. The update request is over TLS, however they do not have Cert pinning in place. Hence, a MiTM adversary (in public wifi) could modify the update binary and have the modified binary (malicious) run on the victim side. 2. In order to PoC the above scenario, i plan to intercept the response containing the legitimate update binary and replace it with a tiny exe (1 kb) that displays "hello world" upon execution. 3.I proxied the windows client via Burp and intercepted the burp response containing the legitimate update binary, however, i am unable to tamper with the response. I get "This message is too large to display" message. The response content length is 88306792 and i can view the HEX format of the response, but unable to delete the response body . upon attempting to do so, the burp GUI doesnt respond. Is there a way to workaround this?

Hannah, PortSwigger Agent | Last updated: Feb 17, 2020 03:47PM UTC

You could write an extension to perform this behavior. You can register an IHttpListener or IProxyListener and modify relevant requests before they are sent. You can find our full Extender API documentation here: https://portswigger.net/burp/extender/api/index.html For more information on writing extensions, please refer to https://portswigger.net/burp/extender Another workaround could be to intercept and modify the outgoing request for the binary update file so that it returns a shorter response file, like a 404. You could then intercept and modify the 404 response and use that to inject the modified binary file.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.