6 February 2013

JSON Decoder

Long time no see. Usually people start such notes with oh-so-cliche quote from Mark Twain, but I've already did that on numerous occasions, so no. Anyway, despite the hidden motto of this blog ("no promises, it will be released when it's done") I wrote something. Finally, yesterday I've overcome my pathological laziness and finished version 1 of very small Burp Extensions - JSON Decoder. Code itself is not very impressing, nor is the functionality, but it's a start - now, knowing the basics I can move to more impressive stuff.

The Extension

Since version 1.5.01 Burp Suite Pro comes with new API for writing extensions. No longer you need to write them in Java, bundle into JAR and are forced to do some mojo magic to make them run. New API also gives you access to much more of the Burp internals. I'm not going to give you a tutorial how to write them, but I encourage you to read some of official tutorials on PortSwigger blog. If I see correctly there are eleven tutorials covering quite wide selection of topics.

So, what is my extension doing? Not that much (at least in this version) - it's just an additional tab with pretty printed JSON packet. I have other plans for that but I need to find time (and I've started flying BMS 4.32 again, so no rest for the wicked). I have some others extensions as a work in progress, but they are not in the ready-to-show state.


Debugging burp extension is a bit like "Why? Because Fuck You, that's why" experience. You have made a typo, mixed expected type or declared too many parameters in function definition? All you get is JavaRuntimeException. You think that you won't made those mistakes? Let me show you what kind of mistakes I did while coding this extension.

Typos - I've spend 30 minutes failing to spot the difference between CreateTxtEditor() and createTxtEditor(). While writing an extension make sure that every API function follows CamelCase conventions (it can be tricky, because python names are usually flat). For example you can convert byte[] data variable in two ways - burp.helpers.byteToString(data) or data.tostring().

Difference between Java.String and byte[] - some functions accept byte[], some String - always check which type function expects and what it returns. It will save you time spent inserting countless println() lines.

Given the low complexity of my code I was able to use oldest, print everything technique of debugging, but if you are writing something more complex please read this blog entry.

Bit more about Burp stuff

If you are a new to Burp I can recommend a book written by my friend - grab it here. You can read it yourself or give to that new Junior Pentester that just joined.


  1. Hi Carstein,

    Sorry for the n00b question, but just how do I get this extension installed into Burp?



  2. Hey,
    First of all make sure you have professional version, because free version does not support extension yet.
    In pro version you should see 'Extender' tab - there should be an Add button there.

  3. When loading your extensions I got this in errors tab:

    Traceback (most recent call last):
    File "/tmp/burp-extensions/JSONDecoder.py", line 7, in
    import json
    ImportError: No module named json

    at org.python.core.Py.ImportError(Py.java:304)
    at org.python.core.imp.import_first(imp.java:755)
    at org.python.core.imp.import_module_level(imp.java:837)
    at org.python.core.imp.importName(imp.java:917)
    at org.python.core.ImportFunction.__call__(__builtin__.java:1220)
    at org.python.core.PyObject.__call__(PyObject.java:357)
    at org.python.core.__builtin__.__import__(__builtin__.java:1173)
    at org.python.core.imp.importOne(imp.java:936)
    at org.python.pycode._pyx1.f$0(/tmp/burp-extensions/JSONDecoder.py:53)
    at org.python.pycode._pyx1.call_function(/tmp/burp-extensions/JSONDecoder.py)
    at org.python.core.PyTableCode.call(PyTableCode.java:165)
    at org.python.core.PyCode.call(PyCode.java:18)
    at org.python.core.Py.runCode(Py.java:1275)
    at org.python.core.__builtin__.execfile_flags(__builtin__.java:522)
    at org.python.util.PythonInterpreter.execfile(PythonInterpreter.java:225)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at burp.j5b.(Unknown Source)
    at burp.teb.a(Unknown Source)
    at burp.sfc.run(Unknown Source)
    at java.lang.Thread.run(Thread.java:745)

    WTF ?

  4. You are using Jython 2.5, json module was added in 2.7.

  5. nice it works now.