Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Modify Executable in the Intercept Response Tab

Muralidharan | Last updated: Feb 16, 2020 05:45PM UTC

Hi Folks, I have the following test use case with Burp and i kindly request your insight to resolving this: 1. I need to showcase a proof that a windows client (target) doesnt perform signature validation on the client side for its updates. The update request is over TLS, however they do not have Cert pinning in place. Hence, a MiTM adversary (in public wifi) could modify the update binary and have the modified binary (malicious) run on the victim side. 2. In order to PoC the above scenario, i plan to intercept the response containing the legitimate update binary and replace it with a tiny exe (1 kb) that displays "hello world" upon execution. 3.I proxied the windows client via Burp and intercepted the burp response containing the legitimate update binary, however, i am unable to tamper with the response. I get "This message is too large to display" message. The response content length is 88306792 and i can view the HEX format of the response, but unable to delete the response body . upon attempting to do so, the burp GUI doesnt respond. Is there a way to workaround this?

Hannah, PortSwigger Agent | Last updated: Feb 17, 2020 03:47PM UTC