Re: [Burp-users] Stuck on Phase4 (shuffling)

[Graham K. <gr...@gr...>]

(Going back on list)...

Yes, the lines that you marked are the correct ones.

On Tue, December 23, 2014 6:37 am, Moter Pent wrote:
> Sorry.  By "files" I actually meant "lines".
>
> On Mon, Dec 22, 2014 at 1:37 PM, Moter Pent <mot...@gm...> wrote:
>
>> Ah, that's much better.  I have created a backup just in case but want
>> to
>> make sure I get the correct lines, here's a snippit from the manifest.
>> My
>> assumption is that I want to zap the files marked with the -> (I left
>> some
>> leading and trailing lines in for context).  Sound right?
>>
>> ...
>> r0040hA mAAQ EH9 C BAAFL BAAAA A BAA BAA I BUEJGq BJJyAb BTCnjJ A A J
>> d0015/home/someuser/archive
>>
>> -> t0023t/home/someuser/archive/a_someuser.nsf
>> -> r0047hA mAIs IG0 B BAAFL BAAAA A M5UAAA BAA BnJzY BUW8XC BUW8XE
>> BUW8XE
>> A A J
>> -> f0022/home/someuser/archive/a_someuser.nsf
>> -> x002C13846446080:55fb6aed93ec645beb4cac6d31fa3a1a
>>
>> r0040hA mAAR EH9 F BAAFL BAAAA A BAA BAA I BTmgjW BHq2Va BTCnjJ A A J
>> d0014/home/someuser/citrix
>> ...
>>
>>
>> On Tue, Dec 23, 2014 at 4:26 AM, Graham Keeling <gr...@gr...> wrote:
>>
>>> On Tue, December 23, 2014 6:04 am, Moter Pent wrote:
>>> > Thanks Graham,
>>> >
>>> >> Is it always the same file that it complains about?
>>> >
>>> > Yes.
>>> >
>>> >> I would see if the file exists ...
>>> >
>>> > I have managed to clobber (delete) these files while trying to
>>> resolve
>>> the
>>> > issue.
>>> > They no longer exist.
>>> >
>>> >> *) Edit the manifest fragments in the 'finishing' directory to
>>> remove
>>> >>    mentions of somefile.nsf. Then burp will not try to do anything
>>> with
>>> > it when
>>> >>    it resumes. The files to edit are called 'phase2' and
>>> 'unchanged'.
>>> If
>>> > you
>>> >>    want to try this, let me know and I will help you with the lines
>>> that
>>> > you
>>> >>    need to delete.
>>> >
>>> > This sounds like a good option though I can't seem to find any files
>>> > called
>>> > 'phase2' or 'unchanged' in the finishing directory.  What am I
>>> missing?
>>>
>>> Ah, sorry, by phase4, they have been merged into a single file. You
>>> should
>>> have a manifest or manifest.gz. If gz, you will want to gunzip it, then
>>> remove the linss related to the file, then gzip it again.
>>>
>>> There will be four adjacent lines to delete.
>>> One represents file stats/permissions/etc.
>>> One represents the location of the file on the server.
>>> One represents the location of the file on the client.
>>> One starts with 'x' and represents the size of the data, and a
>>> checksum.
>>>
>>>
>>> Best make a copy of the manifest before you delete anything.
>>>
>>>
>>
>