@@ -77,6 +77,8 @@ public class BurpExtender implements IBurpExtender, IScannerCheck, ITab, ActionL
7777
7878 private IHttpRequestResponse [] selectedItems ;
7979
80+ private char insertionPointChar ;
81+
8082
8183 /*
8284 * TODO
@@ -152,6 +154,8 @@ public void registerExtenderCallbacks(final IBurpExtenderCallbacks callbacks)
152154 " resolveClass method, by inserting checks on the object type" +
153155 " before deserializing the received object." ;
154156
157+ insertionPointChar = (char )167 ;
158+
155159 stdout .println ("Java Deserialization Scanner v0.3" );
156160 stdout .println ("Created by: Federico Dotta" );
157161 stdout .println ("" );
@@ -587,7 +591,7 @@ public void enableDisableActiveScanChecks() {
587591
588592 public void clearInsertionPoint () {
589593
590- requestArea .setText (requestArea .getText ().replace ("§" ,"" ));
594+ requestArea .setText (requestArea .getText ().replace ("" + insertionPointChar ,"" ));
591595
592596 Highlighter highlighter = requestArea .getHighlighter ();
593597 highlighter .removeAllHighlights ();
@@ -624,7 +628,7 @@ public void insertInjectionCharacters() {
624628
625629 String requestString = requestArea .getText ().trim ();
626630
627- String newRequestString = requestString .substring (0 , start ) + "§" + requestString .substring (start , end ) + "§" + requestString .substring (end , requestString .length ());
631+ String newRequestString = requestString .substring (0 , start ) + insertionPointChar + requestString .substring (start , end ) + insertionPointChar + requestString .substring (end , requestString .length ());
628632
629633 requestArea .setText (newRequestString );
630634
@@ -646,8 +650,8 @@ public void executeManualTest(boolean base64) {
646650 attackBase64Button .setEnabled (false );
647651
648652 String requestString = requestArea .getText ().trim ();
649- int payloadFrom = requestString .indexOf ('§' );
650- int payloadTo = requestString .lastIndexOf ('§' );
653+ int payloadFrom = requestString .indexOf (insertionPointChar );
654+ int payloadTo = requestString .lastIndexOf (insertionPointChar );
651655
652656 boolean positiveResult = false ;
653657
0 commit comments