search

Anof-cyber / PyCript

Burp Suite extension for bypassing client-side encryption for pentesting and bug bounty
https://pycript.souravkalal.tech/
MIT License
185 stars 25 forks source link

JSON payload includes an extra space when using python scripts #7

Closed Draoken closed 2 months ago

Draoken commented 6 months ago

Have you gone through the Documentation or Video Tutorial

Describe the bug When you use the automatic encryption feature with Python along with the Request Type of parameter value, the resulting payload adds an additional space in the json body causing an error. It is between the key and the value (after the colon).

To Reproduce Steps to reproduce the behavior:

  1. Configure settings similar to screenshot below
  2. Use automatic encrypt function with a JSON request
  3. Observe the extra space in the resulting request in the Logger/Comparer tab of BurpSuite

Expected behavior An extra space should not be added, the payload should sit exactly in the same spot as before. This is not an issue with the encrypting script, as the resulting payload is exactly correct. Removing the space causes the request to successfully pass.

Screenshots image image

Desktop (please complete the following information):

Anof-cyber commented 6 months ago

Is it possible to share the json request body (if you can update the value with dummy value).

Also can you confirm if it only happens with auto encrypt? Or is it same when click on pycript tab in repeater.

By default pycript tries to beautify the json, can you check if its same in raw and pretty within request.

Draoken commented 6 months ago

It is the same when you click on pycript tab in repeater.

image

I found the exact spot that I was able to fix the issue. The red highlight is where it's adding a space, and I added my "fix" below it in green. I'm sure you can find something more elegant than what I did.

image

Anof-cyber commented 6 months ago

Just for reference, can you confirm if the back-end application/API (the one you are working on in the screenshot) gives any error if space are there.

Its a default python JSON behaviour to add spaces when json.dump is used.

Draoken commented 6 months ago

Yes, that's why I had to fix it this as the space was breaking the server response