初探Burp Suite API 开发

0x00 环境准备

要使用python进行BurpSuite插件的开发需要安装Jython。下载地址:http://www.jython.org/downloads.html

安装完成后,加载jython的jar包到BurpSuite运行环境中。

0x01 BurpSuite API中常见的类

IBurpExtender

该类中有个registerExtenderCallbacks方法,该方法在插件被加载后会被调用,在所有扩展插件中必须实现这个接口。

java的调用方法:

void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks)

Parameters:
callbacks - An IBurpExtenderCallbacks object.

python的调用方法,python需要对这个方法传入的参数进行处理,处理的是为了更加方便的调用基本接口的方法,这里就列出了一些方法,其他的可以参考IBurpExtenderCallbacks的内容。

def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

IHttpListener

该类是用来注册HTTP监听器,然后对获取到的请求或响应包进行处理,有个processHttpMessage的方法用于对请求和响应的数据包进行自定义操作,该方法在发送请求之前和接收响应之后会被调用。

java的调用方法:

void processHttpMessage(int toolFlag,
                      boolean messageIsRequest,
                      IHttpRequestResponse messageInfo)

Parameters:
toolFlag - A flag indicating the Burp tool that issued the request. Burp tool flags are defined in the IBurpExtenderCallbacks interface.
messageIsRequest - Flags whether the method is being invoked for a request or response.
messageInfo - Details of the request / response to be processed. Extensions can call the setter methods on this object to update the current message and so modify Burp's behavior.

python的调用方法:

def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedResponse.getBodyOffset():].tostring()

......

IHttpRequestResponse

该接口用来获取HTTP中请求和响应的HTTP信息,如果是响应包的HTTP信息,需要在请求被发送后才能获取到。

该接口有getComment(),getHighlight(),getHttpService(),getRequest(),getResponse(),setComment(java.lang.String comment),setHighlight(java.lang.String color),setHttpService(IHttpService httpService),setRequest(byte[] message),setResponse(byte[] message) 这些方法。可以直接在官方接口文档中查看。

其中getHttpService()方法会返回IHttpService的对象。如果需要获取协议,主机,端口信息的,就需要对IHttpService对象里相应的方法进行调用。

java的调用方法:

IHttpService getHttpService()
This method is used to retrieve the HTTP service for this request / response.
Returns:
An IHttpService object containing details of the HTTP service.

python的调用方法:

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

IHttpService

该接口用来获取可以被发送的请求包的详细内容,有getHost(),getPort(),getProtocol这个三个方法。

java的调用方法:

java.lang.String getHost()
This method returns the hostname or IP address for the service.
Returns:
The hostname or IP address for the service.

int getPort()
This method returns the port number for the service.
Returns:
The port number for the service.

java.lang.String getProtocol()
This method returns the protocol for the service.
Returns:
The protocol for the service. Expected values are "http" or "https".

python的调用方法:

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

IResponseInfo

该接口是用来获取响应包的详细内容的,通过IExtensionHelpers.analyzeResponse()的方法调用该对象中的方法。

该接口有getBodyOffset(),getCookies(),getHeaders(),getInferredMimeType(),getStatedMimeType(),getStatusCode()的方法。

java的调用方法:

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the response.
Returns:
The HTTP headers contained in the response.

int getBodyOffset()
This method is used to obtain the offset within the response where the message body begins.
Returns:
The offset within the response where the message body begins.


short getStatusCode()
This method is used to obtain the HTTP status code contained in the response.
Returns:
The HTTP status code contained in the response.


java.util.List<ICookie> getCookies()
This method is used to obtain details of the HTTP cookies set in the response.
Returns:
A list of ICookie objects representing the cookies set in the response, if any.


java.lang.String getStatedMimeType()
This method is used to obtain the MIME type of the response, as stated in the HTTP headers.
Returns:
A textual label for the stated MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.


java.lang.String getInferredMimeType()
This method is used to obtain the MIME type of the response, as inferred from the contents of the HTTP message body.
Returns:
A textual label for the inferred MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.

python的调用方法:

#获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

IRequestInfo

该接口是用来获取请求包的详细内容的,通过IExtensionHelpers.analyzeRequest()的方法调用该对象中的方法。

该接口有getBodyOffset(),getContentType(),getHeaders(),getMethod(),getParameters(),getUrl()的方法。

java的调用方法:

java.lang.String getMethod()
This method is used to obtain the HTTP method used in the request.
Returns:
The HTTP method used in the request.

java.net.URL getUrl()
This method is used to obtain the URL in the request.
Returns:
The URL in the request.

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the request.
Returns:
The HTTP headers contained in the request.

java.util.List<IParameter> getParameters()
This method is used to obtain the parameters contained in the request.
Returns:
The parameters contained in the request.

int getBodyOffset()
This method is used to obtain the offset within the request where the message body begins.
Returns:
The offset within the request where the message body begins.

byte getContentType()
This method is used to obtain the content type of the message body.
Returns:
An indication of the content type of the message body. Available types are defined within this interface.

python的调用方法:

#获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeRequest(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()

0x02 示例代码

#-*-Thinking-*-
#coding=utf8
from burp import IBurpExtender
from burp import IHttpListener
from burp import IHttpRequestResponse
from burp import IResponseInfo
from burp import IRequestInfo
from burp import IHttpService

import re
# Class BurpExtender (Required) contaning all functions used to interact with Burp Suite API

print 'Thinking\'s find JSON callback Bui~'

class BurpExtender(IBurpExtender, IHttpListener):

    # define registerExtenderCallbacks: From IBurpExtender Interface 
    def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

    # define processHttpMessage: From IHttpListener Interface 
    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()
                response_StatusCode = analyzedResponse.getStatusCode()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()


                #获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

                #第一种情况:url中带有callback,且返回的是json数据。
                expressionA = r'.*(callback).*'
                expressionB = r'.*(application/json|application/javascript).*'
                expressionC = r'.*(text/html|application/javascript).*'
                for rqheader in request_header:
                    if rqheader.startswith("Host"):
                        rqhost = rqheader
                        break
                ishtml = 0        
                for rpheader in response_headers:
                    if rpheader.startswith("Content-Type:")  and re.match(expressionC,rpheader):
                        ishtml = 1

                    if rpheader.startswith("Content-Type:")  and  re.match(expressionB,rpheader):                            
                        if re.match(expressionA,request_header[0]):
                            print '='*10,'[success|有callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',request_header[0],'\n\n[ResponseBody]',response_bodys[0:30],'\n\n\n'
                            break

                #第二种情况:url中没有带callback,但是通过添加callback参数后,便返回了带方法名的json数据。
                if not re.match(expressionA,request_header[0]):
                    new_headers = request_header
                    if '?' in new_headers[0]:
                        new_headers[0] = new_headers[0].replace('?','?callback=BuiBui&')
                    else:
                        new_headers[0] = new_headers[0][:-9] +'?callback=BuiBui'

                    req = self._helpers.buildHttpMessage(new_headers, request_bodys) 
                    ishttps = False
                    if port == 443:
                        ishttps = True

                    if response_StatusCode == 200 and ishtml == 1:  
                        rep = self._callbacks.makeHttpRequest(host, port, ishttps, req)
                        #TODO 在某些情况下makeHttpRequest时候会出现一些bug,得到的结果但是取不到response,很奇怪(已经解决,404页面取不到正文返回包)

                        #新的请求请求包
                        analyzedreq = self._helpers.analyzeResponse(rep)
                        req_headers = analyzedreq.getHeaders()
                        req_bodys = rep[analyzedreq.getBodyOffset():].tostring()


                        #新的请求响应包
                        analyzedrep = self._helpers.analyzeResponse(rep)
                        rep_headers = analyzedrep.getHeaders()
                        rep_bodys = rep[analyzedrep.getBodyOffset():].tostring()


                        if 'BuiBui' in rep_bodys:
                            for repheader in rep_headers:
                                if repheader.startswith("Content-Type:")  and  re.match(expressionB,repheader):
                                    print '='*10,'[success|发现隐藏callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',req_headers[0],'\n\n[ResponseBody]',rep_bodys[0:30],'\n\n\n'
                                    break

0x03 加载插件

当请求中有callback或隐藏callback且返回包是json格式的便会在output上打印记录。

原文发布于微信公众号 - 漏斗社区(newdooneSec)

原文发表时间:2018-07-06

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

发表于

我来说两句

0 条评论
登录 后参与评论

相关文章

来自专栏程序猿DD

新年彩蛋:Spring Boot自定义Banner

在2016年的最后一天,借用Spring Boot的Banner向各位程序猿同仁们问候一声:Happy New Year。 ? 接下来我们就来介绍一下这个轻松愉...

2347
来自专栏非著名程序员

Android 使用 ApachePOI 组件读写 Word doc 和 docx 文件

最近在项目中要生成Word的doc和docx文件,一番百度google之后,发现通过java语言实现的主流是Apache的POI组件。除了POI,这里还有另一种...

76810
来自专栏Java与Android技术栈

使用Kotlin Coroutines简单改造原有的爬虫框架

NetDiscover 是一款基于 Vert.x、RxJava2 实现的爬虫框架。因为我最近正好在学习 Kotlin 的 Coroutines,在学习过程中尝试...

1352
来自专栏Spark学习技巧

Hbase源码系列之scan源码解析及调优

一,hbase的scan基本使用问题介绍 Hbase的Scan方法是基于Rowkey进行数据扫描的,过程中client会将我们的请求,转化为向服务端的RPC请求...

4358
来自专栏张泽旭的专栏

基于spring boot sftp文件上传

对sftp文件上传将行封装,实现连接的单例模式,完成线程安全的改进,sftp文件上传下载失败的重试。

3691
来自专栏世界第一语言是java

微信扫码支付、网站接入微信支付-java

2.2K5
来自专栏ChaMd5安全团队

Real World CTF国际大赛 部分WP

题目描述里写平台很安全,请不要攻击。 所以尝试抓包,往Cookie的uid进行sqli

1531
来自专栏技术博客

Asp.Net Web API 2第十五课——Model Validation(模型验证)

阅读本文之前,您也可以到Asp.Net Web API 2 系列导航进行查看 http://www.cnblogs.com/aehyok/p/3446289.h...

1002
来自专栏码农分享

对LinqtoExcel的扩展 【数据有限性,逻辑有效性】

接着上文的内容继续讲,上文中我提到了对Excel操作帮助类库LinqToExcel类库的优缺点和使用方法。我也讲到了自己在使用中碰到的问题,我也开发了一个简单的...

1858
来自专栏我的技术专栏

Socket编程(4)TCP粘包问题及解决方案

1203

扫码关注云+社区

领取腾讯云代金券