Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
This extension registers an IHttpListener configured to execute a custom script editable via the Script tab added to Burp. The script is executed in the context with the following global and local variables (extender, callbacks, helpers, toolFlag, messageIsRequest, messageInfo).
from java.awt import Font
from javax.swing import JScrollPane, JTextPane
from javax.swing.text import SimpleAttributeSet
from burp import IBurpExtender, IExtensionStateListener, IHttpListener, ITab
import base64
import traceback
class BurpExtender(IBurpExtender, IExtensionStateListener, IHttpListener, ITab):
def registerExtenderCallbacks(self, callbacks):
self.callbacks = callbacks
self.helpers = callbacks.helpers
self.scriptpane = JTextPane()
self.scriptpane.setFont(Font('Monospaced', Font.PLAIN, 11))
self.scrollpane = JScrollPane()
self.scrollpane.setViewportView(self.scriptpane)
self._code = compile('', '<string>', 'exec')
self._script = ''
script = callbacks.loadExtensionSetting('script')
if script:
script = base64.b64decode(script)
self.scriptpane.document.insertString(
self.scriptpane.document.length,
script,
SimpleAttributeSet())
self._script = script
self._code = compile(script, '<string>', 'exec')
callbacks.registerExtensionStateListener(self)
callbacks.registerHttpListener(self)
callbacks.customizeUiComponent(self.getUiComponent())
callbacks.addSuiteTab(self)
self.scriptpane.requestFocus()
def extensionUnloaded(self):
try:
self.callbacks.saveExtensionSetting(
'script', base64.b64encode(self._script))
except Exception:
traceback.print_exc(file=self.callbacks.getStderr())
return
def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
try:
globals_ = {}
locals_ = {'extender': self,
'callbacks': self.callbacks,
'helpers': self.helpers,
'toolFlag': toolFlag,
'messageIsRequest': messageIsRequest,
'messageInfo': messageInfo
}
exec(self.script, globals_, locals_)
except Exception:
traceback.print_exc(file=self.callbacks.getStderr())
return
def getTabCaption(self):
return 'Script'
def getUiComponent(self):
return self.scrollpane
@property
def script(self):
end = self.scriptpane.document.length
_script = self.scriptpane.document.getText(0, end)
if _script == self._script:
return self._code
self._script = _script
self._code = compile(_script, '<string>', 'exec')
return self._code
@mwielgoszewski

This comment has been minimized.

Copy link
Owner Author

mwielgoszewski commented Jul 24, 2014

Changed scope of extender, callbacks, and helpers variables to the local variable scope. Result should be a slight increase in performance as we avoid searching the global namespace for a variable.

@irsdl

This comment has been minimized.

Copy link

irsdl commented Jan 17, 2018

Is there any way to import more burp modules such as IParameter?

@FranklinYu

This comment has been minimized.

Copy link

FranklinYu commented Jul 13, 2018

Great work. This has been published in BApp Store: https://portswigger.net/bappstore/eb563ada801346e6bdb7a7d7c5c52583.

@egilas

This comment has been minimized.

Copy link

egilas commented Jan 12, 2019

Sample code:

if (messageIsRequest):
	# Crude state:
	fname="c:/BURP/mystate5.txt"
	
	with open(fname,"r+") as myfile:
		myvalue=myfile.read()
		myvalue=int(myvalue)
		myvalue+=1
		print(myvalue)
		myfile.seek(0)
		myfile.write(str(myvalue))
		myfile.truncate()

	reqbytes=messageInfo.getRequest()
	req=helpers.analyzeRequest(reqbytes)
	headers=req.getHeaders()
	mydate="date: Wed, 22 Feb 2019 14:40:"+str(myvalue)+" GMT"
	headers.add(mydate)
	print(mydate)
	msgbody=reqbytes[(req.getBodyOffset()):]
	newreq=helpers.buildHttpMessage(headers,msgbody)
	messageInfo.setRequest(newreq)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.