Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Strange characters in request/response

Tobias | Last updated: Dec 17, 2019 06:49AM UTC

Hi all, I am trying to intercept communication from Silverlight WCF service. When looking into the request and response I see several strange characters (like rectangle, trademarks and arrows) which I guess are not intended here. Looks somehow like an encoding issue. Someone else can see everything in a clear way? What could be the reason? I have already tried out different version of Burp Community Edition (like 2.1.04, 1.7.36, 1.7.35, 1.7.05). I am using WCF Deserializer, but caused by weird characters the request cannot be deserialized and result is unreadable. This is how the request looks like (trimmed at the end): POST /[...]/Service.svc/normal HTTP/1.1 Accept: */* Accept-Language: en-DE Referer: [...] Content-Length: 1959 Accept-Encoding: gzip, deflate Content-Type: application/soap+msbin1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; rv:11.0) like Gecko Host: [...] Pragma: no-cache Connection: close V s aVD  Does anyone has an idea? Thank you and best regards.

Michelle, PortSwigger Agent | Last updated: Dec 17, 2019 08:58AM UTC

When you say someone else can see everything, is that for the same communications or for a different target?

Hannah, PortSwigger Agent | Last updated: Dec 17, 2019 02:22PM UTC

Hi Tobias Do you and your friend use the same extensions and versions? Have you tried changing your character set or system font (User options > Display)?

Burp User | Last updated: Dec 19, 2019 05:33PM UTC

Hi Michelle, yes, same target. We both listen to same application and he sees everything well decoded and me not. I even tried now pro trial version to check, if it was related to Burp version, but still the same. Best regards, Tobias

Burp User | Last updated: Dec 20, 2019 09:00AM UTC

BTW, if I copy raw request to notepad++ I can see characters that were previously shown as square to be the following shortcuts: STX, VT, SOH, EOT, ACK, BS, RS ...

Burp User | Last updated: Dec 20, 2019 01:04PM UTC

Hi Hannah, thanks for your answer. Yes, version is same (both 1.7.37 pro). And only extension we are using is WCF Deserializer installed from BApp Store. While he is able to see proper deserialized request in WCF Deserializer tab, I do see only hieroglyphics. Font I have not changed yet (only character sets). I am using default Courier New 13pt. Any suggestion which font to use instead? Best regards Tobias

Hannah, PortSwigger Agent | Last updated: Dec 20, 2019 02:01PM UTC

Hi Tobias Is the raw request that the two of you are receiving identical, or does it differ? With regards to fonts, I would recommend setting it to the same as your friends, or if they are already the same, try Dialog or just plain Courier. You could also try some trial and error to see what font works best.

X01X02QQWER | Last updated: Jan 08, 2024 12:53AM UTC

PLEASE HELP ME I HAVE THE SAME THING !!!!!!!!!

Hannah, PortSwigger Agent | Last updated: Jan 08, 2024 12:02PM UTC

Hi If you try changing the font set under "Settings > User interface > Inspector and message editor > HTTP message display", do you continue to have this issue? Sometimes specific fonts don't have characters for your data, so they get displayed as a box instead.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.