Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

No API stack nor full parameter value when using Infiltrator with a private Collaborator server

Nicolas | Last updated: Mar 18, 2017 06:28PM UTC

[Tested with Burp Suite Pro 1.7.19] I instrument Jenkins 1.580.2 like that: java -jar ${JENKINS_HOME}/infiltrator.jar --non-interactive --report-parameter-values=true --report-call-stacks=true --target-paths=/path/to/war/ If I use the public Collaborator server, everything is fine. But when I use my own Collaborator server (using a dedicated domain), I _never_ have the call stack or full parameter value (using Scanner or the manual client). Is that a known limitation of private Collaborator servers? Did I miss something when configuring my Collaborator? Notes: - the private Collaborator instance uses a self-signed SSL cert + the SMTPS port isn't reachable - health check is OK, with some warnings - I think that instrumentation is OK, because the same patched app works well with a public Collaborator Thanks in advance!

Burp User | Last updated: Mar 19, 2017 10:39AM UTC

Culprit found the culrpit (thanks to Santiago): the Collaborator self-signed cert wasn't trusted by the app, and that was blocking some interactions. Adding "--use-http=true" at patch time solved the problem. Adding the cert to the local keystore should have work too (untested).

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.