Dynamic x-nonce for Oracle Banking Digital Experience

burp.py

from burp import IBurpExtender
from burp import ISessionHandlingAction
from burp import ITab

import sys
import json
sys.path.append('/usr/local/lib/python2.7/dist-packages')

import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class BurpExtender(IBurpExtender, ITab,ISessionHandlingAction):
    
    def registerExtenderCallbacks(self, callbacks):
        callbacks.setExtensionName("Dynamic x-nonce")
        self._callbacks = callbacks
        self._helpers = callbacks.getHelpers()
        callbacks.registerSessionHandlingAction(self)

        self.nonce_keys = []

    def getTabCaption(self):
        return "Dynamic x-nonce"

    def getActionName(self):
        return "Dynamic x-nonce"

    def get_nonce(self,furl,cookies):
        import requests
        ret = []
        
        burp0_url = furl + "/digx/v1/session/nonce?locale=en"
        burp0_cookies = {"JSESSIONID": cookies}
        burp0_headers = {"Connection": "close", 
        "Accept": "*/*", "X-Requested-With": "XMLHttpRequest", "x-noncecount": "80", 
        "User-Agent": "Handle x-nonce", 
        "Content-Type": "application/json", 
        "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9"}
        proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
        zz = requests.post(burp0_url, headers=burp0_headers,proxies=proxies, cookies=burp0_cookies, verify=False)
        if zz.status_code == 200:
            if 'x-nonce' in zz.headers.keys():
                jn = json.loads(zz.headers['x-nonce'])
                for i in (jn['nonce']):
                    ret.append(i)
        return ret

    def performAction(self, currentRequest, macroItems):
        self.requestInfo = self._helpers.analyzeRequest(currentRequest.getRequest())
        headers = self.requestInfo.getHeaders()
        if 'Cookie: JSESSIONID=' in str(headers):
            if not len(self.nonce_keys):
                for header in headers:
                    if header.split(" ")[0] == "Cookie:":
                        cookie_v = header.split(" ")[1]
                        final_cookie = cookie_v.split("JSESSIONID=")[1]
                        service = currentRequest.getHttpService()
                        furl = str(service.getProtocol()) + "://" + str(service.getHost()) + ":" + str(service.getPort())
                        self.nonce_keys = self.get_nonce(furl,final_cookie)

            c = self.nonce_keys[0]
            msgBody = currentRequest.getRequest()[self.requestInfo.getBodyOffset():]
            i=0
            for header in headers:
                if header.split(" ")[0] == "x-nonce:":
                    headers[i]="x-nonce: "+ c
                i=i+1
            s = self.nonce_keys.pop(0)
            message = self._helpers.buildHttpMessage(headers, msgBody)
            currentRequest.setRequest(message)