buby 1.3.3-java → 1.5.0-java

Sign up to get free protection for your applications and to get access to all the features.
Files changed (109) hide show
  1. data/README.rdoc +28 -14
  2. data/Rakefile +96 -6
  3. data/VERSION.yml +5 -0
  4. data/bin/buby +2 -0
  5. data/buby.gemspec +102 -17
  6. data/{java/src → ext/buby/burp}/BurpExtender.java +189 -29
  7. data/ext/burp_interfaces/burp/IBurpExtender.java +31 -0
  8. data/ext/burp_interfaces/burp/IBurpExtenderCallbacks.java +785 -0
  9. data/ext/burp_interfaces/burp/IContextMenuFactory.java +38 -0
  10. data/ext/burp_interfaces/burp/IContextMenuInvocation.java +156 -0
  11. data/ext/burp_interfaces/burp/ICookie.java +53 -0
  12. data/ext/burp_interfaces/burp/IExtensionHelpers.java +352 -0
  13. data/ext/burp_interfaces/burp/IExtensionStateListener.java +27 -0
  14. data/ext/burp_interfaces/burp/IHttpListener.java +37 -0
  15. data/ext/burp_interfaces/burp/IHttpRequestResponse.java +102 -0
  16. data/ext/burp_interfaces/burp/IHttpRequestResponsePersisted.java +26 -0
  17. data/ext/burp_interfaces/burp/IHttpRequestResponseWithMarkers.java +44 -0
  18. data/ext/burp_interfaces/burp/IHttpService.java +39 -0
  19. data/ext/burp_interfaces/burp/IInterceptedProxyMessage.java +116 -0
  20. data/ext/burp_interfaces/burp/IIntruderAttack.java +31 -0
  21. data/ext/burp_interfaces/burp/IIntruderPayloadGenerator.java +50 -0
  22. data/ext/burp_interfaces/burp/IIntruderPayloadGeneratorFactory.java +40 -0
  23. data/ext/burp_interfaces/burp/IIntruderPayloadProcessor.java +45 -0
  24. data/{java/src → ext/burp_interfaces}/burp/IMenuItemHandler.java +36 -40
  25. data/ext/burp_interfaces/burp/IMessageEditor.java +64 -0
  26. data/ext/burp_interfaces/burp/IMessageEditorController.java +49 -0
  27. data/ext/burp_interfaces/burp/IMessageEditorTab.java +102 -0
  28. data/ext/burp_interfaces/burp/IMessageEditorTabFactory.java +38 -0
  29. data/ext/burp_interfaces/burp/IParameter.java +104 -0
  30. data/ext/burp_interfaces/burp/IProxyListener.java +37 -0
  31. data/ext/burp_interfaces/burp/IRequestInfo.java +95 -0
  32. data/ext/burp_interfaces/burp/IResponseInfo.java +54 -0
  33. data/ext/burp_interfaces/burp/IScanIssue.java +120 -0
  34. data/ext/burp_interfaces/burp/IScanQueueItem.java +80 -0
  35. data/ext/burp_interfaces/burp/IScannerCheck.java +89 -0
  36. data/ext/burp_interfaces/burp/IScannerInsertionPoint.java +156 -0
  37. data/ext/burp_interfaces/burp/IScannerInsertionPointProvider.java +38 -0
  38. data/ext/burp_interfaces/burp/IScannerListener.java +30 -0
  39. data/ext/burp_interfaces/burp/IScopeChangeListener.java +25 -0
  40. data/ext/burp_interfaces/burp/ISessionHandlingAction.java +51 -0
  41. data/ext/burp_interfaces/burp/ITab.java +38 -0
  42. data/ext/burp_interfaces/burp/ITempFile.java +33 -0
  43. data/ext/burp_interfaces/burp/ITextEditor.java +90 -0
  44. data/lib/buby/burp_extender/console_frame.rb +33 -0
  45. data/lib/buby/burp_extender/console_pane.rb +26 -0
  46. data/lib/buby/burp_extender/console_tab.rb +15 -0
  47. data/lib/buby/burp_extender/context_menu.rb +29 -0
  48. data/lib/buby/burp_extender/context_menu_factory.rb +17 -0
  49. data/lib/buby/burp_extender/context_menu_item.rb +13 -0
  50. data/lib/buby/burp_extender/jcheck_box_menu_item.rb +12 -0
  51. data/lib/buby/burp_extender/jmenu.rb +11 -0
  52. data/lib/buby/burp_extender/jmenu_item.rb +12 -0
  53. data/lib/buby/burp_extender/menu.rb +11 -0
  54. data/lib/buby/burp_extender/menu_item.rb +12 -0
  55. data/lib/buby/burp_extender.rb +339 -0
  56. data/lib/buby/context_menu_factory.rb +35 -0
  57. data/lib/buby/cookie.rb +37 -0
  58. data/lib/buby/extender.rb +156 -0
  59. data/lib/buby/http_listener.rb +29 -0
  60. data/lib/buby/{extends → implants}/buby_array_wrapper.rb +0 -0
  61. data/lib/buby/implants/context_menu_invocation.rb +113 -0
  62. data/lib/buby/implants/cookie.rb +47 -0
  63. data/lib/buby/implants/extension_helpers.rb +286 -0
  64. data/lib/buby/{extends → implants}/http_request_response.rb +8 -1
  65. data/lib/buby/implants/intercepted_proxy_message.rb +53 -0
  66. data/lib/buby/implants/intruder_attack.rb +42 -0
  67. data/lib/buby/implants/jruby.rb +64 -0
  68. data/lib/buby/implants/message_editor.rb +70 -0
  69. data/lib/buby/implants/message_editor_controller.rb +60 -0
  70. data/lib/buby/implants/parameter.rb +84 -0
  71. data/lib/buby/implants/request_info.rb +47 -0
  72. data/lib/buby/implants/response_info.rb +44 -0
  73. data/lib/buby/{extends → implants}/scan_issue.rb +1 -2
  74. data/lib/buby/implants/scan_queue_item.rb +53 -0
  75. data/lib/buby/implants/scanner_insertion_point.rb +92 -0
  76. data/lib/buby/implants/temp_file.rb +43 -0
  77. data/lib/buby/implants/text_editor.rb +63 -0
  78. data/lib/buby/implants.rb +28 -0
  79. data/lib/buby/intruder_payload_generator.rb +60 -0
  80. data/lib/buby/intruder_payload_generator_factory.rb +32 -0
  81. data/lib/buby/intruder_payload_processor.rb +38 -0
  82. data/lib/buby/message_editor_controller.rb +41 -0
  83. data/lib/buby/message_editor_tab.rb +98 -0
  84. data/lib/buby/message_editor_tab_factory.rb +28 -0
  85. data/lib/buby/parameter/base.rb +40 -0
  86. data/lib/buby/parameter/body.rb +7 -0
  87. data/lib/buby/parameter/cookie.rb +7 -0
  88. data/lib/buby/parameter/url.rb +7 -0
  89. data/lib/buby/parameter.rb +15 -0
  90. data/lib/buby/proxy_listener.rb +26 -0
  91. data/lib/buby/scan_issue.rb +112 -0
  92. data/lib/buby/scanner_check.rb +84 -0
  93. data/lib/buby/scanner_insertion_point.rb +118 -0
  94. data/lib/buby/scanner_insertion_point_provider.rb +27 -0
  95. data/lib/buby/scanner_listener.rb +22 -0
  96. data/lib/buby/scope_change_listener.rb +19 -0
  97. data/lib/buby/session_handling_action.rb +43 -0
  98. data/lib/buby/tab.rb +37 -0
  99. data/lib/buby/version.rb +9 -0
  100. data/lib/buby.rb +892 -101
  101. metadata +118 -22
  102. data/VERSION +0 -1
  103. data/java/buby.jar +0 -0
  104. data/java/src/burp/IBurpExtender.java +0 -180
  105. data/java/src/burp/IBurpExtenderCallbacks.java +0 -373
  106. data/java/src/burp/IHttpRequestResponse.java +0 -156
  107. data/java/src/burp/IScanIssue.java +0 -106
  108. data/java/src/burp/IScanQueueItem.java +0 -76
  109. data/lib/buby/extends.rb +0 -4
data/README.rdoc CHANGED
@@ -26,6 +26,25 @@ Buby is implemented using an abstract Ruby event handler and interface class. Th
26
26
 
27
27
  The java BurpExtender included with Buby is an implementation of IBurpExtender which is the interface API supplied by PortSwigger for writing extensions to Burp Suite. It mostly acts as a method proxy between Ruby and Java, doing very little except event handler proxying between the java and ruby runtimes with run-time type conversion as needed.
28
28
 
29
+ == Caveat
30
+
31
+ Burp's extension interfaces have changed significantly in 1.5.01. I don't yet know how compatible this will be with Burp versions 1.5.0 and lower going forward. If you want compatibility with Burp Suite versions 1.5.0 and earlier stick with Buby version 1.3.3 or prior.
32
+
33
+ I will keep the API provided by earlier Buby versions and mark methods deprecated as required. Hopefully, I'll be able to keep them around for a while so old buby scripts will continue to work for a while.
34
+
35
+ Methods removed/deprecated in 1.5.01 interfaces:
36
+ * IBurpExtenderCallbacks.setCommandLineArgs (removed no replacement)
37
+ * IBurpExtenderCallbacks.applicationClosing (removed use IExtensionStateListener instead)
38
+ * IBurpExtenderCallbacks.getParameters (deprecated, use IExtensionHelpers analyze methods instead)
39
+ * IBurpExtenderCallbacks.getHeaders (deprecated, use IExtensionHelpers analyze methods instead)
40
+ * IBurpExtenderCallbacks.registerMenuItem (deprecated, use IBurpExtenderCalbacks.registerContextMenuFactory instead)
41
+ * IMenuItemHandler (deprecated, use IContextMenuFactory instead)
42
+
43
+ The deprecated getPatameters and getHeaders methods will, for now, call the equivalent methods on IBurpExtenderCallbacks. At some point soon they'll forward the calls to the correct interface before being removed entirely in favor of the new interfaces.
44
+
45
+ In 2.0 bin/buby to use a bash script as the primary starting point for the current script - which will be renamed to bin/buby.rb
46
+
47
+ ... And one more thing. The next version of buby will require JRuby 1.7.0+. It won't use 1.9 syntax for a little while. So, extensions that require 1.8 will still work for now. Just don't forget to add the `--1.8` switch to JRuby when starting buby.
29
48
 
30
49
  == REQUIREMENTS:
31
50
 
@@ -59,16 +78,15 @@ Here are manual instructions if you want or need to build things yourself:
59
78
 
60
79
  ==== Step 2. Compile BurpExtender.java. Include jruby.jar in the classpath:
61
80
 
62
- cd buby/java/src
63
- javac -classpath (.../jruby/root)/lib/jruby.jar:. BurpExtender.java
81
+ Install the development dependencies:
82
+ jruby -S gem install jeweler rake-compiler
64
83
 
65
- ==== Step 3. Create a new java/buby.jar
84
+ ==== Step 3. Build with rake
66
85
 
67
- jar cvf ../buby.jar .
86
+ jruby -S rake build
68
87
 
69
88
  ==== Step 4. Build a local gem and install it
70
89
 
71
- cd ../../
72
90
  jruby -S gem build buby.gemspec
73
91
  jruby -S gem install --local buby-*.gem
74
92
 
@@ -91,8 +109,7 @@ though the actual directory may need to be created.
91
109
  Here's how I do it. I have my jruby installation under my home directory.
92
110
  Your configuration details can be substituted below.
93
111
 
94
- mkdir ~/jruby-1.1.5/lib/ruby/1.8/java
95
- ln -s ~/tools/burp.jar ~/jruby-1.1.5/lib/ruby/1.8/java/burp.jar
112
+ ln -s ~/tools/burp.jar ~/jruby-1.7.1/lib/ruby/1.9/java/burp.jar
96
113
 
97
114
  Now everything should be ready to go. Try at least the first few parts of the
98
115
  test below to confirm everything is set up.
@@ -256,13 +273,10 @@ And, assuming 'www.example.com' checks for valid request verbs, you should see s
256
273
 
257
274
  == CREDIT:
258
275
  * Burp and Burp Suite are trademarks of PortSwigger(ltd)
259
- Copyright 2011 PortSwigger Ltd. All rights reserved.
276
+ Copyright 2012 PortSwigger Ltd. All rights reserved.
260
277
  See http://portswigger.net for license terms.
261
278
 
262
- * This ruby library and the accompanying BurpExtender.java implementation was
263
- originally written by Eric Monti @ Matasano Security. This ruby library is
264
- currently maintained by Timur Duehr @ Matasano Security.Matasano Security claims no
265
- professional or legal affiliation with PortSwigger LTD.
279
+ * This ruby library and the accompanying BurpExtender.java implementation was written by Timur Duehr @ Matasano Security. The original version of this library and BurpExtender.java implementation was written my Eric Monti @ Matasano Security. Matasano Security claims no professional or legal affiliation with PortSwigger LTD.
266
280
 
267
281
  However, the authors would like to express their personal and professional
268
282
  respect and admiration to Burp's authors and appreciation to PortSwigger for
@@ -274,7 +288,7 @@ And, assuming 'www.example.com' checks for valid request verbs, you should see s
274
288
  == LICENSE:
275
289
 
276
290
  * Burp and Burp Suite are trademarks of PortSwigger Ltd.
277
- Copyright 2011 PortSwigger Ltd. All rights reserved.
291
+ Copyright 2012 PortSwigger Ltd. All rights reserved.
278
292
  See http://portswigger.net for license terms.
279
293
 
280
294
  * The Buby Ruby library and its accompanying BurpExtender implementation are
@@ -283,7 +297,7 @@ And, assuming 'www.example.com' checks for valid request verbs, you should see s
283
297
  (The MIT License)
284
298
 
285
299
  Copyright (C) 2009 Eric Monti, Matasano Security
286
- Copyright (C) 2010-2011 Timur Duehr, Matasano Security
300
+ Copyright (C) 2010-2012 Timur Duehr, Matasano Security
287
301
 
288
302
  Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
289
303
 
data/Rakefile CHANGED
@@ -2,24 +2,26 @@ require 'rubygems'
2
2
  require 'rake'
3
3
  require 'rake/clean'
4
4
 
5
- CLOBBER.add '**/*.class', '**/*.jar', "doc", '.yardoc'
5
+ CLEAN.add 'tmp'
6
+ CLOBBER.add '**/*.class', '**/buby.jar', "doc", '.yardoc'
6
7
 
7
8
  begin
8
9
  require 'jeweler'
9
- Jeweler::Tasks.new do |gem|
10
+ jeweler = Jeweler::Tasks.new do |gem|
10
11
  gem.name = "buby"
11
12
  gem.summary = %q{Buby is a mashup of JRuby with the popular commercial web security testing tool Burp Suite from PortSwigger}
12
13
  gem.description = %q{Buby is a mashup of JRuby with the popular commercial web security testing tool Burp Suite from PortSwigger. Burp is driven from and tied to JRuby with a Java extension using the BurpExtender API. This extension aims to add Ruby scriptability to Burp Suite with an interface comparable to the Burp's pure Java extension interface.}
13
- gem.email = "emonti@matasano.com, td@matasano.com"
14
+ gem.email = "td@matasano.com"
14
15
  gem.homepage = "http://tduehr.github.com/buby"
15
16
  gem.authors = ["Eric Monti, tduehr"]
16
17
  gem.platform = "java"
17
- gem.files.include "**/*.jar"
18
+ gem.files.include "**/buby.jar"
19
+ gem.files.include "**/burp_interfaces.jar"
18
20
  gem.test_files = ["test/buby_test.rb"]
19
- gem.require_paths << 'java'
20
21
  gem.rdoc_options = ["--main", "README.rdoc"]
21
22
  gem.extra_rdoc_files = ["History.txt", "README.rdoc", "bin/buby"]
22
- end
23
+ gem.add_development_dependency "rake-compiler", "~> 0.8.1"
24
+ end.jeweler
23
25
  Jeweler::GemcutterTasks.new
24
26
  rescue LoadError
25
27
  puts "Jeweler (or a dependency) not available. Install it with: sudo gem install jeweler"
@@ -58,6 +60,94 @@ end
58
60
  begin
59
61
  require 'yard'
60
62
  YARD::Rake::YardocTask.new
63
+ YARD::Rake::YardocTask.new(:todo) do |yard|
64
+ yard.options.concat ['--query', '@todo']
65
+ yard.options << "--list"
66
+ end
67
+ rescue LoadError
68
+ end
69
+
70
+ begin
71
+ require 'rake/javaextensiontask'
72
+ Rake::JavaExtensionTask.new('burp_interfaces', jeweler.gemspec)
73
+ Rake::JavaExtensionTask.new('buby', jeweler.gemspec) do |jet|
74
+ jet.classpath = "lib/burp_interfaces.jar"
75
+ end
76
+ task :test => :compile
77
+ task :build => :compile
61
78
  rescue LoadError
79
+ warn 'rake-compiler not found. java compilation must be performed manually'
62
80
  end
63
81
 
82
+ namespace :version do
83
+ task :nice do
84
+ version_hash = YAML.load_file 'VERSION.yml'
85
+ version_string = ""
86
+ version_string << version_hash[:major].to_s
87
+ version_string << ".#{version_hash[:minor].to_s}"
88
+ version_string << ".#{version_hash[:patch].to_s}"
89
+ version_string << ".#{version_hash[:build].to_s}" if version_hash[:build]
90
+ File.open('lib/buby/version.rb', 'w') do |file|
91
+ file.write <<EOS
92
+ class Buby
93
+ module Version
94
+ STRING = "#{version_string}"
95
+ MAJOR = #{version_hash[:major].to_i}
96
+ MINOR = #{version_hash[:minor].to_i}
97
+ PATCH = #{version_hash[:patch].to_i}
98
+ BUILD = #{version_hash[:build].inspect}
99
+ end
100
+ end
101
+ EOS
102
+ end
103
+ jeweler.repo.add 'lib/buby/version.rb'
104
+ jeweler.repo.commit "fixup! Version bump to #{version_string}"
105
+ puts "Buby::Version updated to #{version_string}"
106
+ end
107
+
108
+ namespace :bump do
109
+ task :patch do
110
+ Rake::Task["version:nice"].invoke
111
+ end
112
+ task :patch do
113
+ Rake::Task["version:nice"].invoke
114
+ end
115
+ task :patch do
116
+ Rake::Task["version:nice"].invoke
117
+ end
118
+ end
119
+ end
120
+
121
+ desc "Start Buby in interactive mode with all runtime dependencies loaded"
122
+ task :test_console, [:script] do |t,args|
123
+ # TODO move to a command
124
+ dirs = ['ext', 'lib'].select { |dir| File.directory?(dir) }
125
+
126
+ original_load_path = $LOAD_PATH
127
+
128
+ cmd = if File.exist?('Gemfile')
129
+ require 'bundler'
130
+ Bundler.setup(:default)
131
+ end
132
+
133
+ # add the project code directories
134
+ $LOAD_PATH.unshift(*dirs)
135
+
136
+ # clear ARGV so IRB is not confused
137
+ ARGV.clear
138
+
139
+ require 'irb'
140
+
141
+ require File.basename Dir.glob('lib/burpsuite_pro_*.jar').last
142
+ require 'burp_interfaces.jar'
143
+ require 'buby.jar'
144
+ require 'buby'
145
+ $burp = Buby.start_burp
146
+
147
+ # set the optional script to run
148
+ IRB.conf[:SCRIPT] = args.script
149
+ IRB.start
150
+
151
+ # return the $LOAD_PATH to it's original state
152
+ $LOAD_PATH.reject! { |path| !(original_load_path.include?(path)) }
153
+ end
data/VERSION.yml ADDED
@@ -0,0 +1,5 @@
1
+ ---
2
+ :major: 1
3
+ :minor: 5
4
+ :patch: 0
5
+ :build:
data/bin/buby CHANGED
@@ -1,5 +1,7 @@
1
1
  #!/usr/bin/env jruby
2
2
 
3
+ require 'burp_interfaces.jar'
4
+ require 'buby.jar'
3
5
  require 'buby'
4
6
  require 'irb'
5
7
  require 'optparse'
data/buby.gemspec CHANGED
@@ -5,14 +5,14 @@
5
5
 
6
6
  Gem::Specification.new do |s|
7
7
  s.name = "buby"
8
- s.version = "1.3.3"
8
+ s.version = "1.5.0"
9
9
  s.platform = "java"
10
10
 
11
11
  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
12
12
  s.authors = ["Eric Monti, tduehr"]
13
- s.date = "2012-12-14"
13
+ s.date = "2013-04-25"
14
14
  s.description = "Buby is a mashup of JRuby with the popular commercial web security testing tool Burp Suite from PortSwigger. Burp is driven from and tied to JRuby with a Java extension using the BurpExtender API. This extension aims to add Ruby scriptability to Burp Suite with an interface comparable to the Burp's pure Java extension interface."
15
- s.email = "emonti@matasano.com, td@matasano.com"
15
+ s.email = "td@matasano.com"
16
16
  s.executables = ["buby"]
17
17
  s.extra_rdoc_files = [
18
18
  "History.txt",
@@ -23,22 +23,104 @@ Gem::Specification.new do |s|
23
23
  "History.txt",
24
24
  "README.rdoc",
25
25
  "Rakefile",
26
- "VERSION",
26
+ "VERSION.yml",
27
27
  "bin/buby",
28
28
  "buby.gemspec",
29
- "java/buby.jar",
30
- "java/src/BurpExtender.java",
31
- "java/src/burp/IBurpExtender.java",
32
- "java/src/burp/IBurpExtenderCallbacks.java",
33
- "java/src/burp/IHttpRequestResponse.java",
34
- "java/src/burp/IMenuItemHandler.java",
35
- "java/src/burp/IScanIssue.java",
36
- "java/src/burp/IScanQueueItem.java",
29
+ "ext/buby/burp/BurpExtender.java",
30
+ "ext/burp_interfaces/burp/IBurpExtender.java",
31
+ "ext/burp_interfaces/burp/IBurpExtenderCallbacks.java",
32
+ "ext/burp_interfaces/burp/IContextMenuFactory.java",
33
+ "ext/burp_interfaces/burp/IContextMenuInvocation.java",
34
+ "ext/burp_interfaces/burp/ICookie.java",
35
+ "ext/burp_interfaces/burp/IExtensionHelpers.java",
36
+ "ext/burp_interfaces/burp/IExtensionStateListener.java",
37
+ "ext/burp_interfaces/burp/IHttpListener.java",
38
+ "ext/burp_interfaces/burp/IHttpRequestResponse.java",
39
+ "ext/burp_interfaces/burp/IHttpRequestResponsePersisted.java",
40
+ "ext/burp_interfaces/burp/IHttpRequestResponseWithMarkers.java",
41
+ "ext/burp_interfaces/burp/IHttpService.java",
42
+ "ext/burp_interfaces/burp/IInterceptedProxyMessage.java",
43
+ "ext/burp_interfaces/burp/IIntruderAttack.java",
44
+ "ext/burp_interfaces/burp/IIntruderPayloadGenerator.java",
45
+ "ext/burp_interfaces/burp/IIntruderPayloadGeneratorFactory.java",
46
+ "ext/burp_interfaces/burp/IIntruderPayloadProcessor.java",
47
+ "ext/burp_interfaces/burp/IMenuItemHandler.java",
48
+ "ext/burp_interfaces/burp/IMessageEditor.java",
49
+ "ext/burp_interfaces/burp/IMessageEditorController.java",
50
+ "ext/burp_interfaces/burp/IMessageEditorTab.java",
51
+ "ext/burp_interfaces/burp/IMessageEditorTabFactory.java",
52
+ "ext/burp_interfaces/burp/IParameter.java",
53
+ "ext/burp_interfaces/burp/IProxyListener.java",
54
+ "ext/burp_interfaces/burp/IRequestInfo.java",
55
+ "ext/burp_interfaces/burp/IResponseInfo.java",
56
+ "ext/burp_interfaces/burp/IScanIssue.java",
57
+ "ext/burp_interfaces/burp/IScanQueueItem.java",
58
+ "ext/burp_interfaces/burp/IScannerCheck.java",
59
+ "ext/burp_interfaces/burp/IScannerInsertionPoint.java",
60
+ "ext/burp_interfaces/burp/IScannerInsertionPointProvider.java",
61
+ "ext/burp_interfaces/burp/IScannerListener.java",
62
+ "ext/burp_interfaces/burp/IScopeChangeListener.java",
63
+ "ext/burp_interfaces/burp/ISessionHandlingAction.java",
64
+ "ext/burp_interfaces/burp/ITab.java",
65
+ "ext/burp_interfaces/burp/ITempFile.java",
66
+ "ext/burp_interfaces/burp/ITextEditor.java",
37
67
  "lib/buby.rb",
38
- "lib/buby/extends.rb",
39
- "lib/buby/extends/buby_array_wrapper.rb",
40
- "lib/buby/extends/http_request_response.rb",
41
- "lib/buby/extends/scan_issue.rb",
68
+ "lib/buby/burp_extender.rb",
69
+ "lib/buby/burp_extender/console_frame.rb",
70
+ "lib/buby/burp_extender/console_pane.rb",
71
+ "lib/buby/burp_extender/console_tab.rb",
72
+ "lib/buby/burp_extender/context_menu.rb",
73
+ "lib/buby/burp_extender/context_menu_factory.rb",
74
+ "lib/buby/burp_extender/context_menu_item.rb",
75
+ "lib/buby/burp_extender/jcheck_box_menu_item.rb",
76
+ "lib/buby/burp_extender/jmenu.rb",
77
+ "lib/buby/burp_extender/jmenu_item.rb",
78
+ "lib/buby/burp_extender/menu.rb",
79
+ "lib/buby/burp_extender/menu_item.rb",
80
+ "lib/buby/context_menu_factory.rb",
81
+ "lib/buby/cookie.rb",
82
+ "lib/buby/extender.rb",
83
+ "lib/buby/http_listener.rb",
84
+ "lib/buby/implants.rb",
85
+ "lib/buby/implants/buby_array_wrapper.rb",
86
+ "lib/buby/implants/context_menu_invocation.rb",
87
+ "lib/buby/implants/cookie.rb",
88
+ "lib/buby/implants/extension_helpers.rb",
89
+ "lib/buby/implants/http_request_response.rb",
90
+ "lib/buby/implants/intercepted_proxy_message.rb",
91
+ "lib/buby/implants/intruder_attack.rb",
92
+ "lib/buby/implants/jruby.rb",
93
+ "lib/buby/implants/message_editor.rb",
94
+ "lib/buby/implants/message_editor_controller.rb",
95
+ "lib/buby/implants/parameter.rb",
96
+ "lib/buby/implants/request_info.rb",
97
+ "lib/buby/implants/response_info.rb",
98
+ "lib/buby/implants/scan_issue.rb",
99
+ "lib/buby/implants/scan_queue_item.rb",
100
+ "lib/buby/implants/scanner_insertion_point.rb",
101
+ "lib/buby/implants/temp_file.rb",
102
+ "lib/buby/implants/text_editor.rb",
103
+ "lib/buby/intruder_payload_generator.rb",
104
+ "lib/buby/intruder_payload_generator_factory.rb",
105
+ "lib/buby/intruder_payload_processor.rb",
106
+ "lib/buby/message_editor_controller.rb",
107
+ "lib/buby/message_editor_tab.rb",
108
+ "lib/buby/message_editor_tab_factory.rb",
109
+ "lib/buby/parameter.rb",
110
+ "lib/buby/parameter/base.rb",
111
+ "lib/buby/parameter/body.rb",
112
+ "lib/buby/parameter/cookie.rb",
113
+ "lib/buby/parameter/url.rb",
114
+ "lib/buby/proxy_listener.rb",
115
+ "lib/buby/scan_issue.rb",
116
+ "lib/buby/scanner_check.rb",
117
+ "lib/buby/scanner_insertion_point.rb",
118
+ "lib/buby/scanner_insertion_point_provider.rb",
119
+ "lib/buby/scanner_listener.rb",
120
+ "lib/buby/scope_change_listener.rb",
121
+ "lib/buby/session_handling_action.rb",
122
+ "lib/buby/tab.rb",
123
+ "lib/buby/version.rb",
42
124
  "samples/drb_buby.rb",
43
125
  "samples/drb_sample_cli.rb",
44
126
  "samples/mechanize_burp.rb",
@@ -50,7 +132,7 @@ Gem::Specification.new do |s|
50
132
  ]
51
133
  s.homepage = "http://tduehr.github.com/buby"
52
134
  s.rdoc_options = ["--main", "README.rdoc"]
53
- s.require_paths = ["lib", "java", "java"]
135
+ s.require_paths = ["lib"]
54
136
  s.rubygems_version = "1.8.24"
55
137
  s.summary = "Buby is a mashup of JRuby with the popular commercial web security testing tool Burp Suite from PortSwigger"
56
138
  s.test_files = ["test/buby_test.rb"]
@@ -59,9 +141,12 @@ Gem::Specification.new do |s|
59
141
  s.specification_version = 3
60
142
 
61
143
  if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
144
+ s.add_development_dependency(%q<rake-compiler>, ["~> 0.8.1"])
62
145
  else
146
+ s.add_dependency(%q<rake-compiler>, ["~> 0.8.1"])
63
147
  end
64
148
  else
149
+ s.add_dependency(%q<rake-compiler>, ["~> 0.8.1"])
65
150
  end
66
151
  end
67
152
 
@@ -1,14 +1,14 @@
1
- //import javax.annotation.PostConstruct;
1
+ package burp;
2
2
 
3
- import burp.IBurpExtender;
4
- import burp.IBurpExtenderCallbacks;
5
- import burp.IScanIssue;
6
- import burp.IHttpRequestResponse;
3
+ import burp.*;
7
4
 
8
5
  import org.jruby.*;
9
6
  import org.jruby.javasupport.JavaUtil;
10
7
  import org.jruby.runtime.ThreadContext;
11
- import org.jruby.runtime.builtin.IRubyObject;
8
+ import org.jruby.runtime.builtin.IRubyObject;
9
+ import org.jruby.RubyBoolean;
10
+ import java.util.List;
11
+ import javax.swing.JMenuItem;
12
12
 
13
13
  /**
14
14
  * This is an implementation of the BurpExtender/IBurpExtender interface
@@ -17,14 +17,52 @@ import org.jruby.runtime.builtin.IRubyObject;
17
17
  * This is a complete implementation of the Burp Extender interfaces available
18
18
  * as of Burp Suite 1.4
19
19
  */
20
- public class BurpExtender implements IBurpExtender {
21
- public final static String INIT_METH = "evt_extender_init";
22
- public final static String PROXYMSG_METH = "evt_proxy_message_raw";
23
- public final static String HTTPMSG_METH = "evt_http_message";
24
- public final static String SCANISSUE_METH = "evt_scan_issue";
25
- public final static String MAINARGS_METH = "evt_commandline_args";
26
- public final static String REG_METH = "evt_register_callbacks";
27
- public final static String CLOSE_METH = "evt_application_closing";
20
+ public class BurpExtender implements IBurpExtender, IExtensionStateListener, IHttpListener, IProxyListener, IScannerListener, IContextMenuFactory, IScopeChangeListener {
21
+
22
+ // Legacy callbacks
23
+ public final static String L_CLOSE_METH = "evt_application_closing";
24
+ public final static String L_HTTPMSG_METH = "evt_http_message";
25
+ public final static String L_INIT_METH = "evt_extender_init";
26
+ public final static String L_MAINARGS_METH = "evt_commandline_args";
27
+ public final static String L_PROXYMSG_METH = "evt_proxy_message_raw";
28
+ public final static String L_SCANISSUE_METH = "evt_scan_issue";
29
+ public final static String L_REG_METH = "evt_register_callbacks";
30
+
31
+ // new style callbacks
32
+ public final static String INIT_METH = "extender_initialize";
33
+ public final static String REG_METH = "register_callbacks";
34
+ public final static String PROXYMSG_METH = "process_proxy_message";
35
+ public final static String HTTPMSG_METH = "process_http_messge";
36
+ public final static String SCANISSUE_METH = "new_scan_issue";
37
+
38
+ // new callback methods
39
+ public final static String UNLOAD_METH = "extension_unloaded";
40
+ public final static String MENUFAC_METH = "create_menu_items";
41
+ public final static String SCOPE_METH = "scope_changed";
42
+
43
+
44
+ // Flag used to identify Burp Suite as a whole.
45
+ public static final int TOOL_SUITE = 0x00000001;
46
+ // Flag used to identify the Burp Target tool.
47
+ public static final int TOOL_TARGET = 0x00000002;
48
+ // Flag used to identify the Burp Proxy tool.
49
+ public static final int TOOL_PROXY = 0x00000004;
50
+ // Flag used to identify the Burp Spider tool.
51
+ public static final int TOOL_SPIDER = 0x00000008;
52
+ // Flag used to identify the Burp Scanner tool.
53
+ public static final int TOOL_SCANNER = 0x00000010;
54
+ // Flag used to identify the Burp Intruder tool.
55
+ public static final int TOOL_INTRUDER = 0x00000020;
56
+ // Flag used to identify the Burp Repeater tool.
57
+ public static final int TOOL_REPEATER = 0x00000040;
58
+ // Flag used to identify the Burp Sequencer tool.
59
+ public static final int TOOL_SEQUENCER = 0x00000080;
60
+ // Flag used to identify the Burp Decoder tool.
61
+ public static final int TOOL_DECODER = 0x00000100;
62
+ // Flag used to identify the Burp Comparer tool.
63
+ public static final int TOOL_COMPARER = 0x00000200;
64
+ // Flag used to identify the Burp Extender tool.
65
+ public static final int TOOL_EXTENDER = 0x00000400;
28
66
 
29
67
  // Internal reference to hold the ruby Burp handler
30
68
  private static IRubyObject r_obj = null;
@@ -37,7 +75,7 @@ public class BurpExtender implements IBurpExtender {
37
75
  * However, it is also possible to set this afterwards and even swap in
38
76
  * new objects during runtime.
39
77
  */
40
- public static void set_handler(IRubyObject hnd) { r_obj = hnd; }
78
+ public static void setHandler(IRubyObject hnd) { r_obj = hnd; }
41
79
 
42
80
  /**
43
81
  * Returns the internal Ruby handler reference.
@@ -45,7 +83,7 @@ public class BurpExtender implements IBurpExtender {
45
83
  * The handler is the ruby class or module used for proxying BurpExtender
46
84
  * events into a ruby runtime.
47
85
  */
48
- public static IRubyObject get_handler() { return r_obj; }
86
+ public static IRubyObject getHandler() { return r_obj; }
49
87
 
50
88
 
51
89
  /**
@@ -59,6 +97,8 @@ public class BurpExtender implements IBurpExtender {
59
97
  public BurpExtender() {
60
98
  if (r_obj !=null && r_obj.respondsTo(INIT_METH))
61
99
  r_obj.callMethod(ctx(r_obj), INIT_METH, to_ruby(rt(r_obj), this));
100
+ if (r_obj !=null && r_obj.respondsTo(L_INIT_METH))
101
+ r_obj.callMethod(ctx(r_obj), L_INIT_METH, to_ruby(rt(r_obj), this));
62
102
  }
63
103
 
64
104
 
@@ -68,7 +108,7 @@ public class BurpExtender implements IBurpExtender {
68
108
  * startup.
69
109
  *
70
110
  * This implementation invokes the method defined by
71
- * <code>MAINARGS_METH</code> in the Ruby handler if both the handler
111
+ * <code>L_MAINARGS_METH</code> in the Ruby handler if both the handler
72
112
  * and its ruby method are defined.
73
113
  *
74
114
  * It allows Ruby implementations to control aspects of their behaviour at
@@ -81,8 +121,8 @@ public class BurpExtender implements IBurpExtender {
81
121
  * @param args The command-line arguments passed to Burp Suite on startup.
82
122
  */
83
123
  public void setCommandLineArgs(String[] args) {
84
- if(r_obj != null && r_obj.respondsTo(MAINARGS_METH))
85
- r_obj.callMethod(ctx(r_obj), MAINARGS_METH, to_ruby(rt(r_obj), args));
124
+ if(r_obj != null && r_obj.respondsTo(L_MAINARGS_METH))
125
+ r_obj.callMethod(ctx(r_obj), L_MAINARGS_METH, to_ruby(rt(r_obj), args));
86
126
  }
87
127
 
88
128
  /**
@@ -101,9 +141,25 @@ public class BurpExtender implements IBurpExtender {
101
141
  * <code>IBurpExtenderCallbacks</code> interface.
102
142
  */
103
143
  public void registerExtenderCallbacks(IBurpExtenderCallbacks cb) {
104
- if(r_obj != null && r_obj.respondsTo(REG_METH)) {
105
- cb.issueAlert("[BurpExtender] registering JRuby handler callbacks");
106
- r_obj.callMethod(ctx(r_obj), REG_METH, to_ruby(rt(r_obj), cb));
144
+ cb.setExtensionName("Buby");
145
+ cb.issueAlert("[BurpExtender] registering JRuby handler callbacks");
146
+ cb.registerExtensionStateListener(this);
147
+ cb.registerHttpListener(this);
148
+ cb.registerScannerListener(this);
149
+ cb.registerContextMenuFactory(this);
150
+ cb.registerScopeChangeListener(this);
151
+ if(r_obj != null) {
152
+ boolean respondsLegacyRegister = r_obj.respondsTo(L_REG_METH);
153
+ boolean respondsRegister = r_obj.respondsTo(REG_METH);
154
+
155
+ IRubyObject args[] = {to_ruby(rt(r_obj), cb), RubyBoolean.newBoolean(rt(r_obj), false)};
156
+ if(respondsLegacyRegister && respondsRegister){
157
+ r_obj.callMethod(ctx(r_obj), REG_METH, args[0]);
158
+ r_obj.callMethod(ctx(r_obj), L_REG_METH, args);
159
+ } else if(respondsRegister){
160
+ r_obj.callMethod(ctx(r_obj), REG_METH, args[0]);
161
+ } else if(respondsLegacyRegister)
162
+ r_obj.callMethod(ctx(r_obj), L_REG_METH, args[0]);
107
163
  }
108
164
  }
109
165
 
@@ -112,7 +168,7 @@ public class BurpExtender implements IBurpExtender {
112
168
  * response is received.
113
169
  *
114
170
  * This implementation simply passes all arguments to the Ruby handler's
115
- * method defined by <code>PROXYMSG_METH</code> if both the handler and
171
+ * method defined by <code>L_PROXYMSG_METH</code> if both the handler and
116
172
  * its ruby method are defined.
117
173
  *
118
174
  * This allows Ruby implementations to perform logging functions, modify
@@ -145,6 +201,7 @@ public class BurpExtender implements IBurpExtender {
145
201
  * in the <code>message</code> paramater, or (b) a different object
146
202
  * containing a modified message.
147
203
  */
204
+ @Deprecated
148
205
  public byte[] processProxyMessage(
149
206
  int messageReference,
150
207
  boolean messageIsRequest,
@@ -160,7 +217,7 @@ public class BurpExtender implements IBurpExtender {
160
217
  int[] action )
161
218
  {
162
219
 
163
- if (r_obj != null && r_obj.respondsTo(PROXYMSG_METH)) {
220
+ if (r_obj != null && r_obj.respondsTo(L_PROXYMSG_METH)) {
164
221
  Ruby rt = rt(r_obj);
165
222
  // prepare an alternate action value to present to ruby
166
223
  IRubyObject r_action = to_ruby(rt, action);
@@ -187,7 +244,7 @@ public class BurpExtender implements IBurpExtender {
187
244
  // slurp back in the action value in-case it's been changed
188
245
  action[0] = ((int[])r_action.toJava(int[].class))[0];
189
246
 
190
- IRubyObject ret = r_obj.callMethod(ctx(r_obj), PROXYMSG_METH, pxy_msg);
247
+ IRubyObject ret = r_obj.callMethod(ctx(r_obj), L_PROXYMSG_METH, pxy_msg);
191
248
  if(ret != r_msg) {
192
249
  return (byte []) ret.toJava(byte[].class);
193
250
  }
@@ -196,8 +253,35 @@ public class BurpExtender implements IBurpExtender {
196
253
  return message;
197
254
  }
198
255
 
256
+ /**
257
+ * This method is invoked when an HTTP message is being processed by the
258
+ * Proxy.
259
+ *
260
+ * This method corresponds with Buby#process_proxy_message
261
+ *
262
+ * @param messageIsRequest Indicates whether the HTTP message is a request
263
+ * or a response.
264
+ * @param message An
265
+ * <code>IInterceptedProxyMessage</code> object that extensions can use to
266
+ * query and update details of the message, and control whether the message
267
+ * should be intercepted and displayed to the user for manual review or
268
+ * modification.
269
+ */
270
+ public void processProxyMessage(boolean messageIsRequest, IInterceptedProxyMessage message)
271
+ {
272
+ if (r_obj != null && r_obj.respondsTo(PROXYMSG_METH)) {
273
+ Ruby rt = rt(r_obj);
274
+ IRubyObject http_msg[] = {
275
+ to_ruby(rt, messageIsRequest),
276
+ to_ruby(rt, message)
277
+ };
278
+ r_obj.callMethod(ctx(r_obj), PROXYMSG_METH, http_msg);
279
+ }
280
+ }
281
+
199
282
  /**
200
283
  * Added in Burp 1.2.09
284
+ * @note Changed in Burp 1.5.01+
201
285
  * No javadoc yet but here's what the PortSwigger dev blog has to say:
202
286
  *
203
287
  * The processHttpMessage method is invoked whenever any of Burp's tools
@@ -206,18 +290,47 @@ public class BurpExtender implements IBurpExtender {
206
290
  * can be used to intercept and modify the HTTP traffic of all Burp
207
291
  * tools.
208
292
  */
293
+ @Deprecated
209
294
  public void processHttpMessage(
210
295
  String toolName,
211
296
  boolean messageIsRequest,
212
297
  IHttpRequestResponse messageInfo )
213
298
  {
214
- if (r_obj != null && r_obj.respondsTo(HTTPMSG_METH)) {
299
+ if (r_obj != null && r_obj.respondsTo(L_HTTPMSG_METH)) {
215
300
  Ruby rt = rt(r_obj);
216
301
  IRubyObject http_msg[] = {
217
302
  to_ruby(rt, toolName),
218
303
  to_ruby(rt, messageIsRequest),
219
304
  to_ruby(rt, messageInfo)
220
305
  };
306
+
307
+ r_obj.callMethod(ctx(r_obj), L_HTTPMSG_METH, http_msg);
308
+ }
309
+ }
310
+
311
+ /**
312
+ * @note This is the 1.5.01+ version of this callback
313
+ * This method is invoked when an HTTP request is about to be issued, and
314
+ * when an HTTP response has been received.
315
+ *
316
+ * @param toolFlag A flag indicating the Burp tool that issued the request.
317
+ * Burp tool flags are defined in the
318
+ * <code>IBurpExtenderCallbacks</code> interface.
319
+ * @param messageIsRequest Flags whether the method is being invoked for a
320
+ * request or response.
321
+ * @param messageInfo Details of the request / response to be processed.
322
+ * Extensions can call the setter methods on this object to update the
323
+ * current message and so modify Burp's behavior.
324
+ */
325
+ public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo)
326
+ {
327
+ if (r_obj != null && r_obj.respondsTo(HTTPMSG_METH)) {
328
+ Ruby rt = rt(r_obj);
329
+ IRubyObject http_msg[] = {
330
+ to_ruby(rt, toolFlag),
331
+ to_ruby(rt, messageIsRequest),
332
+ to_ruby(rt, messageInfo)
333
+ };
221
334
 
222
335
  r_obj.callMethod(ctx(r_obj), HTTPMSG_METH, http_msg);
223
336
  }
@@ -233,21 +346,23 @@ public class BurpExtender implements IBurpExtender {
233
346
  public void newScanIssue(IScanIssue issue) {
234
347
  if (r_obj != null && r_obj.respondsTo(SCANISSUE_METH))
235
348
  r_obj.callMethod(ctx(r_obj), SCANISSUE_METH, to_ruby(rt(r_obj), issue));
349
+ if (r_obj != null && r_obj.respondsTo(L_SCANISSUE_METH))
350
+ r_obj.callMethod(ctx(r_obj), L_SCANISSUE_METH, to_ruby(rt(r_obj), issue));
236
351
  }
237
352
 
238
353
 
239
354
  /**
240
355
  * This method is invoked immediately before Burp Suite exits.
241
356
  * This implementation simply invokes the Ruby handler's method defined
242
- * by <code>CLOSE_METH</code> if both the handler and its ruby method are
357
+ * by <code>L_CLOSE_METH</code> if both the handler and its ruby method are
243
358
  * defined.
244
359
  *
245
360
  * This allows implementations to carry out any clean-up actions necessary
246
361
  * (e.g. flushing log files or closing database resources, etc.).
247
362
  */
248
363
  public void applicationClosing() {
249
- if (r_obj != null && r_obj.respondsTo(CLOSE_METH))
250
- r_obj.callMethod(ctx(r_obj), CLOSE_METH);
364
+ if (r_obj != null && r_obj.respondsTo(L_CLOSE_METH))
365
+ r_obj.callMethod(ctx(r_obj), L_CLOSE_METH);
251
366
  }
252
367
 
253
368
  // Private method to return the ThreadContext for a given ruby object.
@@ -308,5 +423,50 @@ public class BurpExtender implements IBurpExtender {
308
423
  * to processProxyMessage.
309
424
  */
310
425
  public final static int ACTION_DONT_INTERCEPT_AND_REHOOK = 0x12;
426
+
427
+ /**
428
+ * Extensions can implement this interface and then call
429
+ * <code>IBurpExtenderCallbacks.registerExtensionStateListener()</code> to
430
+ * register an extension state listener. The listener will be notified of
431
+ * changes to the extension's state. <b>Note:</b> Any extensions that start
432
+ * background threads or open system resources (such as files or database
433
+ * connections) should register a listener and terminate threads / close
434
+ * resources when the extension is unloaded.
435
+ */
436
+ public void extensionUnloaded() {
437
+ if (r_obj != null && r_obj.respondsTo(UNLOAD_METH))
438
+ r_obj.callMethod(ctx(r_obj), UNLOAD_METH);
439
+ }
440
+
441
+ /**
442
+ * This method will be called by Burp when the user invokes a context menu
443
+ * anywhere within Burp. The factory can then provide any custom context
444
+ * menu items that should be displayed in the context menu, based on the
445
+ * details of the menu invocation.
446
+ *
447
+ * @param invocation An object that implements the
448
+ * <code>IMessageEditorTabFactory</code> interface, which the extension can
449
+ * query to obtain details of the context menu invocation.
450
+ * @return A list of custom menu items (which may include sub-menus,
451
+ * checkbox menu items, etc.) that should be displayed. Extensions may
452
+ * return
453
+ * <code>null</code> from this method, to indicate that no menu items are
454
+ * required.
455
+ */
456
+ public List<JMenuItem> createMenuItems(IContextMenuInvocation invocation) {
457
+ // IRubyObject ret = null;
458
+ if (r_obj != null && r_obj.respondsTo(MENUFAC_METH))
459
+ return (RubyArray)r_obj.callMethod(ctx(r_obj), MENUFAC_METH, to_ruby(rt(r_obj), invocation));
460
+ return null;
461
+ }
462
+
463
+ /**
464
+ * This method is invoked whenever a change occurs to Burp's suite-wide
465
+ * target scope.
466
+ */
467
+ public void scopeChanged() {
468
+ if (r_obj != null && r_obj.respondsTo(SCOPE_METH))
469
+ r_obj.callMethod(ctx(r_obj), SCOPE_METH);
470
+ }
311
471
  }
312
472