Burp Suite User Forum

Login to post

System.exit() kills Burp

August | Last updated: Jun 25, 2019 09:38PM UTC

I'm building an extension that will call a Java command line program from within Burp (by calling the main() method). Unfortunately, when the command line tool finishes, it calls System.exit(0); which doesn't just kill the CLI, it also kills Burp entirely. Is there a way to prevent this in Burp? As a side question, when extensions are submitted to the BApp Store do you check for things like malicious calls to System.exit()?

PortSwigger Agent | Last updated: Jun 26, 2019 10:38AM UTC

There's no way to disable System.exit(). I suggest you edit the code from the program you're running and remove the call to System.exit(). Alternatively, using Runtime.exec to run the tool in a separate process. We do check extensions for a number of suspicious calls - including System.exe - before allowing them in the BApp Store.

You need to Log in to post a reply. Or register here, for free.