专栏首页漏斗社区初探Burp Suite API 开发

初探Burp Suite API 开发

0x00 环境准备

要使用python进行BurpSuite插件的开发需要安装Jython。下载地址:http://www.jython.org/downloads.html

安装完成后,加载jython的jar包到BurpSuite运行环境中。

0x01 BurpSuite API中常见的类

IBurpExtender

该类中有个registerExtenderCallbacks方法,该方法在插件被加载后会被调用,在所有扩展插件中必须实现这个接口。

java的调用方法:

void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks)

Parameters:
callbacks - An IBurpExtenderCallbacks object.

python的调用方法,python需要对这个方法传入的参数进行处理,处理的是为了更加方便的调用基本接口的方法,这里就列出了一些方法,其他的可以参考IBurpExtenderCallbacks的内容。

def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

IHttpListener

该类是用来注册HTTP监听器,然后对获取到的请求或响应包进行处理,有个processHttpMessage的方法用于对请求和响应的数据包进行自定义操作,该方法在发送请求之前和接收响应之后会被调用。

java的调用方法:

void processHttpMessage(int toolFlag,
                      boolean messageIsRequest,
                      IHttpRequestResponse messageInfo)

Parameters:
toolFlag - A flag indicating the Burp tool that issued the request. Burp tool flags are defined in the IBurpExtenderCallbacks interface.
messageIsRequest - Flags whether the method is being invoked for a request or response.
messageInfo - Details of the request / response to be processed. Extensions can call the setter methods on this object to update the current message and so modify Burp's behavior.

python的调用方法:

def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedResponse.getBodyOffset():].tostring()

......

IHttpRequestResponse

该接口用来获取HTTP中请求和响应的HTTP信息,如果是响应包的HTTP信息,需要在请求被发送后才能获取到。

该接口有getComment(),getHighlight(),getHttpService(),getRequest(),getResponse(),setComment(java.lang.String comment),setHighlight(java.lang.String color),setHttpService(IHttpService httpService),setRequest(byte[] message),setResponse(byte[] message) 这些方法。可以直接在官方接口文档中查看。

其中getHttpService()方法会返回IHttpService的对象。如果需要获取协议,主机,端口信息的,就需要对IHttpService对象里相应的方法进行调用。

java的调用方法:

IHttpService getHttpService()
This method is used to retrieve the HTTP service for this request / response.
Returns:
An IHttpService object containing details of the HTTP service.

python的调用方法:

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

IHttpService

该接口用来获取可以被发送的请求包的详细内容,有getHost(),getPort(),getProtocol这个三个方法。

java的调用方法:

java.lang.String getHost()
This method returns the hostname or IP address for the service.
Returns:
The hostname or IP address for the service.

int getPort()
This method returns the port number for the service.
Returns:
The port number for the service.

java.lang.String getProtocol()
This method returns the protocol for the service.
Returns:
The protocol for the service. Expected values are "http" or "https".

python的调用方法:

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

IResponseInfo

该接口是用来获取响应包的详细内容的,通过IExtensionHelpers.analyzeResponse()的方法调用该对象中的方法。

该接口有getBodyOffset(),getCookies(),getHeaders(),getInferredMimeType(),getStatedMimeType(),getStatusCode()的方法。

java的调用方法:

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the response.
Returns:
The HTTP headers contained in the response.

int getBodyOffset()
This method is used to obtain the offset within the response where the message body begins.
Returns:
The offset within the response where the message body begins.


short getStatusCode()
This method is used to obtain the HTTP status code contained in the response.
Returns:
The HTTP status code contained in the response.


java.util.List<ICookie> getCookies()
This method is used to obtain details of the HTTP cookies set in the response.
Returns:
A list of ICookie objects representing the cookies set in the response, if any.


java.lang.String getStatedMimeType()
This method is used to obtain the MIME type of the response, as stated in the HTTP headers.
Returns:
A textual label for the stated MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.


java.lang.String getInferredMimeType()
This method is used to obtain the MIME type of the response, as inferred from the contents of the HTTP message body.
Returns:
A textual label for the inferred MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.

python的调用方法:

#获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

IRequestInfo

该接口是用来获取请求包的详细内容的,通过IExtensionHelpers.analyzeRequest()的方法调用该对象中的方法。

该接口有getBodyOffset(),getContentType(),getHeaders(),getMethod(),getParameters(),getUrl()的方法。

java的调用方法:

java.lang.String getMethod()
This method is used to obtain the HTTP method used in the request.
Returns:
The HTTP method used in the request.

java.net.URL getUrl()
This method is used to obtain the URL in the request.
Returns:
The URL in the request.

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the request.
Returns:
The HTTP headers contained in the request.

java.util.List<IParameter> getParameters()
This method is used to obtain the parameters contained in the request.
Returns:
The parameters contained in the request.

int getBodyOffset()
This method is used to obtain the offset within the request where the message body begins.
Returns:
The offset within the request where the message body begins.

byte getContentType()
This method is used to obtain the content type of the message body.
Returns:
An indication of the content type of the message body. Available types are defined within this interface.

python的调用方法:

#获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeRequest(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()

0x02 示例代码

#-*-Thinking-*-
#coding=utf8
from burp import IBurpExtender
from burp import IHttpListener
from burp import IHttpRequestResponse
from burp import IResponseInfo
from burp import IRequestInfo
from burp import IHttpService

import re
# Class BurpExtender (Required) contaning all functions used to interact with Burp Suite API

print 'Thinking\'s find JSON callback Bui~'

class BurpExtender(IBurpExtender, IHttpListener):

    # define registerExtenderCallbacks: From IBurpExtender Interface 
    def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

    # define processHttpMessage: From IHttpListener Interface 
    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()
                response_StatusCode = analyzedResponse.getStatusCode()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()


                #获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

                #第一种情况:url中带有callback,且返回的是json数据。
                expressionA = r'.*(callback).*'
                expressionB = r'.*(application/json|application/javascript).*'
                expressionC = r'.*(text/html|application/javascript).*'
                for rqheader in request_header:
                    if rqheader.startswith("Host"):
                        rqhost = rqheader
                        break
                ishtml = 0        
                for rpheader in response_headers:
                    if rpheader.startswith("Content-Type:")  and re.match(expressionC,rpheader):
                        ishtml = 1

                    if rpheader.startswith("Content-Type:")  and  re.match(expressionB,rpheader):                            
                        if re.match(expressionA,request_header[0]):
                            print '='*10,'[success|有callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',request_header[0],'\n\n[ResponseBody]',response_bodys[0:30],'\n\n\n'
                            break

                #第二种情况:url中没有带callback,但是通过添加callback参数后,便返回了带方法名的json数据。
                if not re.match(expressionA,request_header[0]):
                    new_headers = request_header
                    if '?' in new_headers[0]:
                        new_headers[0] = new_headers[0].replace('?','?callback=BuiBui&')
                    else:
                        new_headers[0] = new_headers[0][:-9] +'?callback=BuiBui'

                    req = self._helpers.buildHttpMessage(new_headers, request_bodys) 
                    ishttps = False
                    if port == 443:
                        ishttps = True

                    if response_StatusCode == 200 and ishtml == 1:  
                        rep = self._callbacks.makeHttpRequest(host, port, ishttps, req)
                        #TODO 在某些情况下makeHttpRequest时候会出现一些bug,得到的结果但是取不到response,很奇怪(已经解决,404页面取不到正文返回包)

                        #新的请求请求包
                        analyzedreq = self._helpers.analyzeResponse(rep)
                        req_headers = analyzedreq.getHeaders()
                        req_bodys = rep[analyzedreq.getBodyOffset():].tostring()


                        #新的请求响应包
                        analyzedrep = self._helpers.analyzeResponse(rep)
                        rep_headers = analyzedrep.getHeaders()
                        rep_bodys = rep[analyzedrep.getBodyOffset():].tostring()


                        if 'BuiBui' in rep_bodys:
                            for repheader in rep_headers:
                                if repheader.startswith("Content-Type:")  and  re.match(expressionB,repheader):
                                    print '='*10,'[success|发现隐藏callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',req_headers[0],'\n\n[ResponseBody]',rep_bodys[0:30],'\n\n\n'
                                    break

0x03 加载插件

当请求中有callback或隐藏callback且返回包是json格式的便会在output上打印记录。

本文分享自微信公众号 - 漏斗社区(newdooneSec)

原文出处及转载信息见文内详细说明,如有侵权,请联系 yunjia_community@tencent.com 删除。

原始发表时间:2018-07-06

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

我来说两句

0 条评论
登录 后参与评论

相关文章

  • 工具| sqlmap payload修改之路(下)

    上周通过一个例子让大家大致了解了sqlmap 如何添加以及修改payload,本周斗哥将带领各位完整地学习sqlmap与payload有关的xml文件下的pay...

    漏斗社区
  • 力作|phpcms_v9.6.1 任意文件下载漏洞

    前面咱们一起学习了phpcms_v9.6.0,任意文件上传漏洞复现的过程,不知道小伙伴们后面有没有想到如何进行批量检测呢?我尝试写了个Python脚本,这里要感...

    漏斗社区
  • 代码审计| Spring框架实例篇

    Java代码审计Spring框架思路篇中,斗哥为大家讲述了如何得到Spring审计的Demo,审计源码,根据IDEA与Spring框架审计思路初步判定是否存在漏...

    漏斗社区
  • 【PAT甲级】Sign In and Sign Out

    版权声明:本文为博主原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。 ...

    喜欢ctrl的cxk
  • Modifying namespace in XML document programmatically

    Modifying namespace in XML document programmatically static XElement stripNS(XEl...

    阿新
  • 聊聊flink LocalEnvironment的execute方法

    flink-java-1.6.2-sources.jar!/org/apache/flink/api/java/DataSet.java

    codecraft
  • 聊聊flink LocalEnvironment的execute方法

    flink-java-1.6.2-sources.jar!/org/apache/flink/api/java/DataSet.java

    codecraft
  • 多目标进化算法应用于提高医药数据领域学习器的性能(CS AI)

    原文标题完整翻译:多目标进化算法应用于提高在医药数据领域使用整体特征选择和离散化模型的学习器的性能

    Donuts_choco
  • Redis 为什么这么快?(9)

    因为单线程已经够用了,CPU不是redis的瓶颈。Redis的瓶颈最有可能是机器内存或者网络带宽。既然单线程容易实现,而且CPU不会成为瓶颈,那就顺理成章地采用...

    兜兜毛毛
  • Kotlin 函数编程详解函数Kotlin 开发者社区

    Functions in Kotlin are declared using the fun keyword:

    一个会写诗的程序员

扫码关注云+社区

领取腾讯云代金券