Skip to content

Instantly share code, notes, and snippets.

@mwielgoszewski
Last active October 27, 2021 01:32
Show Gist options
  • Save mwielgoszewski/7026954 to your computer and use it in GitHub Desktop.
Save mwielgoszewski/7026954 to your computer and use it in GitHub Desktop.
This extension registers an IHttpListener configured to execute a custom script editable via the Script tab added to Burp. The script is executed in the context with the following global and local variables (extender, callbacks, helpers, toolFlag, messageIsRequest, messageInfo).
from java.awt import Font
from javax.swing import JScrollPane, JTextPane
from javax.swing.text import SimpleAttributeSet
from burp import IBurpExtender, IExtensionStateListener, IHttpListener, ITab
import base64
import traceback
class BurpExtender(IBurpExtender, IExtensionStateListener, IHttpListener, ITab):
def registerExtenderCallbacks(self, callbacks):
self.callbacks = callbacks
self.helpers = callbacks.helpers
self.scriptpane = JTextPane()
self.scriptpane.setFont(Font('Monospaced', Font.PLAIN, 11))
self.scrollpane = JScrollPane()
self.scrollpane.setViewportView(self.scriptpane)
self._code = compile('', '<string>', 'exec')
self._script = ''
script = callbacks.loadExtensionSetting('script')
if script:
script = base64.b64decode(script)
self.scriptpane.document.insertString(
self.scriptpane.document.length,
script,
SimpleAttributeSet())
self._script = script
self._code = compile(script, '<string>', 'exec')
callbacks.registerExtensionStateListener(self)
callbacks.registerHttpListener(self)
callbacks.customizeUiComponent(self.getUiComponent())
callbacks.addSuiteTab(self)
self.scriptpane.requestFocus()
def extensionUnloaded(self):
try:
self.callbacks.saveExtensionSetting(
'script', base64.b64encode(self._script))
except Exception:
traceback.print_exc(file=self.callbacks.getStderr())
return
def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
try:
globals_ = {}
locals_ = {'extender': self,
'callbacks': self.callbacks,
'helpers': self.helpers,
'toolFlag': toolFlag,
'messageIsRequest': messageIsRequest,
'messageInfo': messageInfo
}
exec(self.script, globals_, locals_)
except Exception:
traceback.print_exc(file=self.callbacks.getStderr())
return
def getTabCaption(self):
return 'Script'
def getUiComponent(self):
return self.scrollpane
@property
def script(self):
end = self.scriptpane.document.length
_script = self.scriptpane.document.getText(0, end)
if _script == self._script:
return self._code
self._script = _script
self._code = compile(_script, '<string>', 'exec')
return self._code
@tap90
Copy link

tap90 commented Oct 3, 2021

Is there any example? It's very hard understand how to use it without example

@yehgdotnet
Copy link

Is there any example? It's very hard understand how to use it without example

Simply adding header. The code is based on python. Consult python docs if you have issue.

Learn about returned object type from burp
If it's list, python list applies.

headers.add(mydate)
headers.append(mydate)

If it's object, you can call its method

messageInfo.getRequest()

Example codes : https://portswigger.net/burp/extender

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment