Burp complains about a missing "jwt library"

[Hax0rG1rl]

Hi,

Thanks for your work. I got a try of this one and I get an error message while trying to load with burp:

Traceback (most recent call last):
  File "/root/Desktop/burp_suite/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py", line 36, in <module>
    import jwt
ImportError: No module named jwt

	at org.python.core.Py.ImportError(Py.java:328)
	at org.python.core.imp.import_first(imp.java:877)
	at org.python.core.imp.import_module_level(imp.java:972)
	at org.python.core.imp.importName(imp.java:1062)
	at org.python.core.ImportFunction.__call__(__builtin__.java:1280)
	at org.python.core.PyObject.__call__(PyObject.java:431)
	at org.python.core.__builtin__.__import__(__builtin__.java:1232)
	at org.python.core.imp.importOne(imp.java:1081)
	at org.python.pycode._pyx5.f$0(/root/Desktop/burp_suite/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py:546)
	at org.python.pycode._pyx5.call_function(/root/Desktop/burp_suite/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py)
	at org.python.core.PyTableCode.call(PyTableCode.java:167)
	at org.python.core.PyCode.call(PyCode.java:18)
	at org.python.core.Py.runCode(Py.java:1386)
	at org.python.core.__builtin__.execfile_flags(__builtin__.java:535)
	at org.python.util.PythonInterpreter.execfile(PythonInterpreter.java:286)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:564)
	at burp.p9e.<init>(Unknown Source)
	at burp.wi.a(Unknown Source)
	at burp.aif.run(Unknown Source)
	at java.base/java.lang.Thread.run(Thread.java:844)

The package is there as per below:

pip2 freeze | grep PyJWT
PyJWT==1.5.3

Any suggestions?

Regards

[pinnace]

Hey @Os3r3um

By default, Burp uses your Jython environment, which doesn't have pyjwt installed. You'll need to define an import path for extra modules outside of the Jython environment.

If you go to your "Extender -> Options -> Python Environment" settings you can direct Burp to load modules from your non-Jython environment. I've attached a screenshot of my settings, but I use
Anaconda so your path may be different.

The easiest way to get this path this is to run python -c "import sys; print sys.path;", then grep for PyJWT. This should be in some folder named site-packages.

Let me know if this works!

[Hax0rG1rl]

Hi,

Sorry for my late response. Got a hardware failure because of life. Anyway, got tested the workaround and it does not work.

My environment is a Kali Linux, Burp Pro.

Regards.

[pinnace]

@Os3r3um

No problem, I'll try and replicate this issue in a clean environment and get back to you.

[pinnace]

@Os3r3um

Okay, I've replicated the issue.

First, I've pushed a change to make ImportErrors for jwt and rsa non-fatal.

Second, so for my environment (fully updated Kali + Burp Pro) I have pyjwt in the following location:
/usr/lib/python2.7/dist-packages/PyJWT-1.5.3.egg-*. I used /usr/lib/python2.7/dist-packages/ as my module import path in Burp

my rsa libs were in /usr/**local**/lib/python2.7/rsa/, since BurpSuite only accepts one import path I symlinked the libs with ln -s /usr/local/lib/python2.7/dist-packages/rsa /usr/lib/python2.7/dist-packages/

Here is my Burp config for Kali:

Extension successfully loaded

Can you confirm whether or not this works for you?

[Hax0rG1rl]

Thanks for everything. I got it work now. :)

[NBG0x1]

[awesomeaakash]

I am getting following problem ->

[WARNING] module 'rsa' not found.

`Traceback (most recent call last):
File "/home/aakash/Desktop/BurpSuite/BurpTools/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py", line 51, in
import pyasn1
ImportError: No module named pyasn1

at org.python.core.Py.ImportError(Py.java:328)
at org.python.core.imp.import_first(imp.java:877)
at org.python.core.imp.import_module_level(imp.java:972)
at org.python.core.imp.importName(imp.java:1062)
at org.python.core.ImportFunction.__call__(__builtin__.java:1280)
at org.python.core.PyObject.__call__(PyObject.java:431)
at org.python.core.__builtin__.__import__(__builtin__.java:1232)
at org.python.core.imp.importOne(imp.java:1081)
at org.python.pycode._pyx5.f$0(/home/aakash/Desktop/BurpSuite/BurpTools/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py:592)
at org.python.pycode._pyx5.call_function(/home/aakash/Desktop/BurpSuite/BurpTools/burp-jwt-fuzzhelper-extension/burp-jwt-fuzzhelper.py)
at org.python.core.PyTableCode.call(PyTableCode.java:167)
at org.python.core.PyCode.call(PyCode.java:18)
at org.python.core.Py.runCode(Py.java:1386)
at org.python.core.__builtin__.execfile_flags(__builtin__.java:535)
at org.python.util.PythonInterpreter.execfile(PythonInterpreter.java:286)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at burp.dgq.<init>(Unknown Source)
at burp.b8r.a(Unknown Source)
at burp.ba8.lambda$panelLoaded$0(Unknown Source)
at java.lang.Thread.run(Thread.java:748)

`

sudo pip install -r requirements.txt
Requirement already satisfied: pyjwt in /usr/local/lib/python3.5/dist-packages (from -r requirements.txt (line 1)) (1.7.1)
Requirement already satisfied: rsa in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (3.2.3)

[pinnace]

@awesomeaakash

Hmm, can you show me what your "Folder for Loading Modules" path is in your "Python Environment" setting?

[awesomeaakash]

@awesomeaakash

Hmm, can you show me what your "Folder for Loading Modules" path is in your "Python Environment" setting?

Yes here it is ->

python -c "import sys; print sys.path;" ['', '/usr/local/lib/python2.7/dist-packages/JSParser-1.0-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/beautifulsoup4-4.8.0-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/pycurl-7.43.0.3-py2.7-linux-x86_64.egg', '/usr/local/lib/python2.7/dist-packages/netaddr-0.7.19-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/jsbeautifier-1.10.2-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/tornado-6.0.3-py2.7-linux-x86_64.egg', '/usr/local/lib/python2.7/dist-packages/safeurl-0.0.7-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/soupsieve-1.9.4-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/EditorConfig-0.12.2-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/six-1.12.0-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/requests-2.7.0-py2.7.egg', '/usr/local/lib/python2.7/dist-packages/backports.functools_lru_cache-1.5-py2.7.egg', '/usr/lib/python2.7', '/usr/lib/python2.7/plat-x86_64-linux-gnu', '/usr/lib/python2.7/lib-tk', '/usr/lib/python2.7/lib-old', '/usr/lib/python2.7/lib-dynload', '/usr/local/lib/python2.7/dist-packages', '/usr/lib/python2.7/dist-packages', '/usr/lib/python2.7/dist-packages/gtk-2.0', '/usr/lib/python2.7/dist-packages/wx-3.0-gtk2']

[awesomeaakash]

And this ->

`python3 -c "import sys; print(sys.path);"
['', '/usr/lib/python35.zip', '/usr/lib/python3.5', '/usr/lib/python3.5/plat-x86_64-linux-gnu', '/usr/lib/python3.5/lib-dynload', '/usr/local/lib/python3.5/dist-packages', '/usr/lib/python3/dist-packages']

[pinnace]

@awesomeaakash can you show me what you have configured for Burp?

e.g.

[awesomeaakash]

Here it is
/snap/core18/1144/usr/lib/python3/dist-packages

[pinnace]

Gotcha. Well that looks alright. And you have pyasn1 installed, correct?

Also, just noticed that what you provided before is for your python 3 environment

sudo pip install -r requirements.txt
Requirement already satisfied: pyjwt in /usr/local/lib/python3.5/dist-packages (from -r requirements.txt (line 1)) (1.7.1)
Requirement already satisfied: rsa in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (3.2.3)

Can you confirm these libraries are present in the python2.7 directory as well?

[awesomeaakash]

ls /usr/lib/python2.7/dist-packages/ -la | grep rsa lrwxrwxrwx 1 root root 42 Oct 2 12:35 rsa -> /usr/local/lib/python2.7/dist-packages/rsa

But no pyjwt in python2.7 even used commmand sudo pip install pyjwt but its always install in python3.5

[pinnace]

Try python2 -m pip pyjwt