buby 1.3.3-java → 1.5.0-java
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README.rdoc +28 -14
- data/Rakefile +96 -6
- data/VERSION.yml +5 -0
- data/bin/buby +2 -0
- data/buby.gemspec +102 -17
- data/{java/src → ext/buby/burp}/BurpExtender.java +189 -29
- data/ext/burp_interfaces/burp/IBurpExtender.java +31 -0
- data/ext/burp_interfaces/burp/IBurpExtenderCallbacks.java +785 -0
- data/ext/burp_interfaces/burp/IContextMenuFactory.java +38 -0
- data/ext/burp_interfaces/burp/IContextMenuInvocation.java +156 -0
- data/ext/burp_interfaces/burp/ICookie.java +53 -0
- data/ext/burp_interfaces/burp/IExtensionHelpers.java +352 -0
- data/ext/burp_interfaces/burp/IExtensionStateListener.java +27 -0
- data/ext/burp_interfaces/burp/IHttpListener.java +37 -0
- data/ext/burp_interfaces/burp/IHttpRequestResponse.java +102 -0
- data/ext/burp_interfaces/burp/IHttpRequestResponsePersisted.java +26 -0
- data/ext/burp_interfaces/burp/IHttpRequestResponseWithMarkers.java +44 -0
- data/ext/burp_interfaces/burp/IHttpService.java +39 -0
- data/ext/burp_interfaces/burp/IInterceptedProxyMessage.java +116 -0
- data/ext/burp_interfaces/burp/IIntruderAttack.java +31 -0
- data/ext/burp_interfaces/burp/IIntruderPayloadGenerator.java +50 -0
- data/ext/burp_interfaces/burp/IIntruderPayloadGeneratorFactory.java +40 -0
- data/ext/burp_interfaces/burp/IIntruderPayloadProcessor.java +45 -0
- data/{java/src → ext/burp_interfaces}/burp/IMenuItemHandler.java +36 -40
- data/ext/burp_interfaces/burp/IMessageEditor.java +64 -0
- data/ext/burp_interfaces/burp/IMessageEditorController.java +49 -0
- data/ext/burp_interfaces/burp/IMessageEditorTab.java +102 -0
- data/ext/burp_interfaces/burp/IMessageEditorTabFactory.java +38 -0
- data/ext/burp_interfaces/burp/IParameter.java +104 -0
- data/ext/burp_interfaces/burp/IProxyListener.java +37 -0
- data/ext/burp_interfaces/burp/IRequestInfo.java +95 -0
- data/ext/burp_interfaces/burp/IResponseInfo.java +54 -0
- data/ext/burp_interfaces/burp/IScanIssue.java +120 -0
- data/ext/burp_interfaces/burp/IScanQueueItem.java +80 -0
- data/ext/burp_interfaces/burp/IScannerCheck.java +89 -0
- data/ext/burp_interfaces/burp/IScannerInsertionPoint.java +156 -0
- data/ext/burp_interfaces/burp/IScannerInsertionPointProvider.java +38 -0
- data/ext/burp_interfaces/burp/IScannerListener.java +30 -0
- data/ext/burp_interfaces/burp/IScopeChangeListener.java +25 -0
- data/ext/burp_interfaces/burp/ISessionHandlingAction.java +51 -0
- data/ext/burp_interfaces/burp/ITab.java +38 -0
- data/ext/burp_interfaces/burp/ITempFile.java +33 -0
- data/ext/burp_interfaces/burp/ITextEditor.java +90 -0
- data/lib/buby/burp_extender/console_frame.rb +33 -0
- data/lib/buby/burp_extender/console_pane.rb +26 -0
- data/lib/buby/burp_extender/console_tab.rb +15 -0
- data/lib/buby/burp_extender/context_menu.rb +29 -0
- data/lib/buby/burp_extender/context_menu_factory.rb +17 -0
- data/lib/buby/burp_extender/context_menu_item.rb +13 -0
- data/lib/buby/burp_extender/jcheck_box_menu_item.rb +12 -0
- data/lib/buby/burp_extender/jmenu.rb +11 -0
- data/lib/buby/burp_extender/jmenu_item.rb +12 -0
- data/lib/buby/burp_extender/menu.rb +11 -0
- data/lib/buby/burp_extender/menu_item.rb +12 -0
- data/lib/buby/burp_extender.rb +339 -0
- data/lib/buby/context_menu_factory.rb +35 -0
- data/lib/buby/cookie.rb +37 -0
- data/lib/buby/extender.rb +156 -0
- data/lib/buby/http_listener.rb +29 -0
- data/lib/buby/{extends → implants}/buby_array_wrapper.rb +0 -0
- data/lib/buby/implants/context_menu_invocation.rb +113 -0
- data/lib/buby/implants/cookie.rb +47 -0
- data/lib/buby/implants/extension_helpers.rb +286 -0
- data/lib/buby/{extends → implants}/http_request_response.rb +8 -1
- data/lib/buby/implants/intercepted_proxy_message.rb +53 -0
- data/lib/buby/implants/intruder_attack.rb +42 -0
- data/lib/buby/implants/jruby.rb +64 -0
- data/lib/buby/implants/message_editor.rb +70 -0
- data/lib/buby/implants/message_editor_controller.rb +60 -0
- data/lib/buby/implants/parameter.rb +84 -0
- data/lib/buby/implants/request_info.rb +47 -0
- data/lib/buby/implants/response_info.rb +44 -0
- data/lib/buby/{extends → implants}/scan_issue.rb +1 -2
- data/lib/buby/implants/scan_queue_item.rb +53 -0
- data/lib/buby/implants/scanner_insertion_point.rb +92 -0
- data/lib/buby/implants/temp_file.rb +43 -0
- data/lib/buby/implants/text_editor.rb +63 -0
- data/lib/buby/implants.rb +28 -0
- data/lib/buby/intruder_payload_generator.rb +60 -0
- data/lib/buby/intruder_payload_generator_factory.rb +32 -0
- data/lib/buby/intruder_payload_processor.rb +38 -0
- data/lib/buby/message_editor_controller.rb +41 -0
- data/lib/buby/message_editor_tab.rb +98 -0
- data/lib/buby/message_editor_tab_factory.rb +28 -0
- data/lib/buby/parameter/base.rb +40 -0
- data/lib/buby/parameter/body.rb +7 -0
- data/lib/buby/parameter/cookie.rb +7 -0
- data/lib/buby/parameter/url.rb +7 -0
- data/lib/buby/parameter.rb +15 -0
- data/lib/buby/proxy_listener.rb +26 -0
- data/lib/buby/scan_issue.rb +112 -0
- data/lib/buby/scanner_check.rb +84 -0
- data/lib/buby/scanner_insertion_point.rb +118 -0
- data/lib/buby/scanner_insertion_point_provider.rb +27 -0
- data/lib/buby/scanner_listener.rb +22 -0
- data/lib/buby/scope_change_listener.rb +19 -0
- data/lib/buby/session_handling_action.rb +43 -0
- data/lib/buby/tab.rb +37 -0
- data/lib/buby/version.rb +9 -0
- data/lib/buby.rb +892 -101
- metadata +118 -22
- data/VERSION +0 -1
- data/java/buby.jar +0 -0
- data/java/src/burp/IBurpExtender.java +0 -180
- data/java/src/burp/IBurpExtenderCallbacks.java +0 -373
- data/java/src/burp/IHttpRequestResponse.java +0 -156
- data/java/src/burp/IScanIssue.java +0 -106
- data/java/src/burp/IScanQueueItem.java +0 -76
- data/lib/buby/extends.rb +0 -4
metadata
CHANGED
|
@@ -1,18 +1,34 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: buby
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.3.3
|
|
5
4
|
prerelease:
|
|
5
|
+
version: 1.5.0
|
|
6
6
|
platform: java
|
|
7
7
|
authors:
|
|
8
8
|
- Eric Monti, tduehr
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date:
|
|
13
|
-
dependencies:
|
|
12
|
+
date: 2013-04-25 00:00:00.000000000 Z
|
|
13
|
+
dependencies:
|
|
14
|
+
- !ruby/object:Gem::Dependency
|
|
15
|
+
name: rake-compiler
|
|
16
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
17
|
+
requirements:
|
|
18
|
+
- - "~>"
|
|
19
|
+
- !ruby/object:Gem::Version
|
|
20
|
+
version: 0.8.1
|
|
21
|
+
none: false
|
|
22
|
+
requirement: !ruby/object:Gem::Requirement
|
|
23
|
+
requirements:
|
|
24
|
+
- - "~>"
|
|
25
|
+
- !ruby/object:Gem::Version
|
|
26
|
+
version: 0.8.1
|
|
27
|
+
none: false
|
|
28
|
+
prerelease: false
|
|
29
|
+
type: :development
|
|
14
30
|
description: Buby is a mashup of JRuby with the popular commercial web security testing tool Burp Suite from PortSwigger. Burp is driven from and tied to JRuby with a Java extension using the BurpExtender API. This extension aims to add Ruby scriptability to Burp Suite with an interface comparable to the Burp's pure Java extension interface.
|
|
15
|
-
email:
|
|
31
|
+
email: td@matasano.com
|
|
16
32
|
executables:
|
|
17
33
|
- buby
|
|
18
34
|
extensions: []
|
|
@@ -24,22 +40,104 @@ files:
|
|
|
24
40
|
- History.txt
|
|
25
41
|
- README.rdoc
|
|
26
42
|
- Rakefile
|
|
27
|
-
- VERSION
|
|
43
|
+
- VERSION.yml
|
|
28
44
|
- bin/buby
|
|
29
45
|
- buby.gemspec
|
|
30
|
-
-
|
|
31
|
-
-
|
|
32
|
-
-
|
|
33
|
-
-
|
|
34
|
-
-
|
|
35
|
-
-
|
|
36
|
-
-
|
|
37
|
-
-
|
|
46
|
+
- ext/buby/burp/BurpExtender.java
|
|
47
|
+
- ext/burp_interfaces/burp/IBurpExtender.java
|
|
48
|
+
- ext/burp_interfaces/burp/IBurpExtenderCallbacks.java
|
|
49
|
+
- ext/burp_interfaces/burp/IContextMenuFactory.java
|
|
50
|
+
- ext/burp_interfaces/burp/IContextMenuInvocation.java
|
|
51
|
+
- ext/burp_interfaces/burp/ICookie.java
|
|
52
|
+
- ext/burp_interfaces/burp/IExtensionHelpers.java
|
|
53
|
+
- ext/burp_interfaces/burp/IExtensionStateListener.java
|
|
54
|
+
- ext/burp_interfaces/burp/IHttpListener.java
|
|
55
|
+
- ext/burp_interfaces/burp/IHttpRequestResponse.java
|
|
56
|
+
- ext/burp_interfaces/burp/IHttpRequestResponsePersisted.java
|
|
57
|
+
- ext/burp_interfaces/burp/IHttpRequestResponseWithMarkers.java
|
|
58
|
+
- ext/burp_interfaces/burp/IHttpService.java
|
|
59
|
+
- ext/burp_interfaces/burp/IInterceptedProxyMessage.java
|
|
60
|
+
- ext/burp_interfaces/burp/IIntruderAttack.java
|
|
61
|
+
- ext/burp_interfaces/burp/IIntruderPayloadGenerator.java
|
|
62
|
+
- ext/burp_interfaces/burp/IIntruderPayloadGeneratorFactory.java
|
|
63
|
+
- ext/burp_interfaces/burp/IIntruderPayloadProcessor.java
|
|
64
|
+
- ext/burp_interfaces/burp/IMenuItemHandler.java
|
|
65
|
+
- ext/burp_interfaces/burp/IMessageEditor.java
|
|
66
|
+
- ext/burp_interfaces/burp/IMessageEditorController.java
|
|
67
|
+
- ext/burp_interfaces/burp/IMessageEditorTab.java
|
|
68
|
+
- ext/burp_interfaces/burp/IMessageEditorTabFactory.java
|
|
69
|
+
- ext/burp_interfaces/burp/IParameter.java
|
|
70
|
+
- ext/burp_interfaces/burp/IProxyListener.java
|
|
71
|
+
- ext/burp_interfaces/burp/IRequestInfo.java
|
|
72
|
+
- ext/burp_interfaces/burp/IResponseInfo.java
|
|
73
|
+
- ext/burp_interfaces/burp/IScanIssue.java
|
|
74
|
+
- ext/burp_interfaces/burp/IScanQueueItem.java
|
|
75
|
+
- ext/burp_interfaces/burp/IScannerCheck.java
|
|
76
|
+
- ext/burp_interfaces/burp/IScannerInsertionPoint.java
|
|
77
|
+
- ext/burp_interfaces/burp/IScannerInsertionPointProvider.java
|
|
78
|
+
- ext/burp_interfaces/burp/IScannerListener.java
|
|
79
|
+
- ext/burp_interfaces/burp/IScopeChangeListener.java
|
|
80
|
+
- ext/burp_interfaces/burp/ISessionHandlingAction.java
|
|
81
|
+
- ext/burp_interfaces/burp/ITab.java
|
|
82
|
+
- ext/burp_interfaces/burp/ITempFile.java
|
|
83
|
+
- ext/burp_interfaces/burp/ITextEditor.java
|
|
38
84
|
- lib/buby.rb
|
|
39
|
-
- lib/buby/
|
|
40
|
-
- lib/buby/
|
|
41
|
-
- lib/buby/
|
|
42
|
-
- lib/buby/
|
|
85
|
+
- lib/buby/burp_extender.rb
|
|
86
|
+
- lib/buby/burp_extender/console_frame.rb
|
|
87
|
+
- lib/buby/burp_extender/console_pane.rb
|
|
88
|
+
- lib/buby/burp_extender/console_tab.rb
|
|
89
|
+
- lib/buby/burp_extender/context_menu.rb
|
|
90
|
+
- lib/buby/burp_extender/context_menu_factory.rb
|
|
91
|
+
- lib/buby/burp_extender/context_menu_item.rb
|
|
92
|
+
- lib/buby/burp_extender/jcheck_box_menu_item.rb
|
|
93
|
+
- lib/buby/burp_extender/jmenu.rb
|
|
94
|
+
- lib/buby/burp_extender/jmenu_item.rb
|
|
95
|
+
- lib/buby/burp_extender/menu.rb
|
|
96
|
+
- lib/buby/burp_extender/menu_item.rb
|
|
97
|
+
- lib/buby/context_menu_factory.rb
|
|
98
|
+
- lib/buby/cookie.rb
|
|
99
|
+
- lib/buby/extender.rb
|
|
100
|
+
- lib/buby/http_listener.rb
|
|
101
|
+
- lib/buby/implants.rb
|
|
102
|
+
- lib/buby/implants/buby_array_wrapper.rb
|
|
103
|
+
- lib/buby/implants/context_menu_invocation.rb
|
|
104
|
+
- lib/buby/implants/cookie.rb
|
|
105
|
+
- lib/buby/implants/extension_helpers.rb
|
|
106
|
+
- lib/buby/implants/http_request_response.rb
|
|
107
|
+
- lib/buby/implants/intercepted_proxy_message.rb
|
|
108
|
+
- lib/buby/implants/intruder_attack.rb
|
|
109
|
+
- lib/buby/implants/jruby.rb
|
|
110
|
+
- lib/buby/implants/message_editor.rb
|
|
111
|
+
- lib/buby/implants/message_editor_controller.rb
|
|
112
|
+
- lib/buby/implants/parameter.rb
|
|
113
|
+
- lib/buby/implants/request_info.rb
|
|
114
|
+
- lib/buby/implants/response_info.rb
|
|
115
|
+
- lib/buby/implants/scan_issue.rb
|
|
116
|
+
- lib/buby/implants/scan_queue_item.rb
|
|
117
|
+
- lib/buby/implants/scanner_insertion_point.rb
|
|
118
|
+
- lib/buby/implants/temp_file.rb
|
|
119
|
+
- lib/buby/implants/text_editor.rb
|
|
120
|
+
- lib/buby/intruder_payload_generator.rb
|
|
121
|
+
- lib/buby/intruder_payload_generator_factory.rb
|
|
122
|
+
- lib/buby/intruder_payload_processor.rb
|
|
123
|
+
- lib/buby/message_editor_controller.rb
|
|
124
|
+
- lib/buby/message_editor_tab.rb
|
|
125
|
+
- lib/buby/message_editor_tab_factory.rb
|
|
126
|
+
- lib/buby/parameter.rb
|
|
127
|
+
- lib/buby/parameter/base.rb
|
|
128
|
+
- lib/buby/parameter/body.rb
|
|
129
|
+
- lib/buby/parameter/cookie.rb
|
|
130
|
+
- lib/buby/parameter/url.rb
|
|
131
|
+
- lib/buby/proxy_listener.rb
|
|
132
|
+
- lib/buby/scan_issue.rb
|
|
133
|
+
- lib/buby/scanner_check.rb
|
|
134
|
+
- lib/buby/scanner_insertion_point.rb
|
|
135
|
+
- lib/buby/scanner_insertion_point_provider.rb
|
|
136
|
+
- lib/buby/scanner_listener.rb
|
|
137
|
+
- lib/buby/scope_change_listener.rb
|
|
138
|
+
- lib/buby/session_handling_action.rb
|
|
139
|
+
- lib/buby/tab.rb
|
|
140
|
+
- lib/buby/version.rb
|
|
43
141
|
- samples/drb_buby.rb
|
|
44
142
|
- samples/drb_sample_cli.rb
|
|
45
143
|
- samples/mechanize_burp.rb
|
|
@@ -52,22 +150,20 @@ homepage: http://tduehr.github.com/buby
|
|
|
52
150
|
licenses: []
|
|
53
151
|
post_install_message:
|
|
54
152
|
rdoc_options:
|
|
55
|
-
- --main
|
|
153
|
+
- "--main"
|
|
56
154
|
- README.rdoc
|
|
57
155
|
require_paths:
|
|
58
156
|
- lib
|
|
59
|
-
- java
|
|
60
|
-
- java
|
|
61
157
|
required_ruby_version: !ruby/object:Gem::Requirement
|
|
62
158
|
requirements:
|
|
63
|
-
- -
|
|
159
|
+
- - ">="
|
|
64
160
|
- !ruby/object:Gem::Version
|
|
65
161
|
version: !binary |-
|
|
66
162
|
MA==
|
|
67
163
|
none: false
|
|
68
164
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
69
165
|
requirements:
|
|
70
|
-
- -
|
|
166
|
+
- - ">="
|
|
71
167
|
- !ruby/object:Gem::Version
|
|
72
168
|
version: !binary |-
|
|
73
169
|
MA==
|
data/VERSION
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
1.3.3
|
data/java/buby.jar
DELETED
|
Binary file
|
|
@@ -1,180 +0,0 @@
|
|
|
1
|
-
package burp;
|
|
2
|
-
|
|
3
|
-
/*
|
|
4
|
-
* @(#)IBurpExtender.java
|
|
5
|
-
*
|
|
6
|
-
* Copyright PortSwigger Ltd. All rights reserved.
|
|
7
|
-
*
|
|
8
|
-
* This code may be used to extend the functionality of Burp Suite and Burp
|
|
9
|
-
* Suite Professional, provided that this usage does not violate the
|
|
10
|
-
* license terms for those products.
|
|
11
|
-
*/
|
|
12
|
-
|
|
13
|
-
/**
|
|
14
|
-
* This interface allows third-party code to extend Burp Suite's functionality.
|
|
15
|
-
*
|
|
16
|
-
* Implementations must be called BurpExtender, in the package burp,
|
|
17
|
-
* must be declared public, and must provide a default (public, no-argument)
|
|
18
|
-
* constructor. On startup, Burp Suite searches its classpath for the class
|
|
19
|
-
* burp.BurpExtender, and attempts to dynamically load and instantiate this
|
|
20
|
-
* class. The <code>IBurpExtender</code> methods implemented will then be
|
|
21
|
-
* dynamically invoked as appropriate.<p>
|
|
22
|
-
*
|
|
23
|
-
* Partial implementations are acceptable. The class will be used provided at
|
|
24
|
-
* least one of the interface's methods is implemented.<p>
|
|
25
|
-
*
|
|
26
|
-
* To make use of the interface, create a class called BurpExtender, in the
|
|
27
|
-
* package burp, which implements one or more methods of the interface, and
|
|
28
|
-
* place this into the application's classpath at startup. For example, if
|
|
29
|
-
* Burp Suite is loaded from burp.jar, and BurpProxyExtender.jar contains the
|
|
30
|
-
* class burp.BurpExtender, use the following command to launch Burp Suite and
|
|
31
|
-
* load the IBurpExtender implementation:<p>
|
|
32
|
-
*
|
|
33
|
-
* <PRE> java -classpath burp.jar;BurpProxyExtender.jar burp.StartBurp</PRE>
|
|
34
|
-
*
|
|
35
|
-
* (On Linux-based platforms, use a colon character instead of the semi-colon
|
|
36
|
-
* as the classpath separator.)
|
|
37
|
-
*/
|
|
38
|
-
|
|
39
|
-
public interface IBurpExtender
|
|
40
|
-
{
|
|
41
|
-
/**
|
|
42
|
-
* This method is invoked immediately after the implementation's constructor
|
|
43
|
-
* to pass any command-line arguments that were passed to Burp Suite on
|
|
44
|
-
* startup. It allows implementations to control aspects of their behaviour
|
|
45
|
-
* at runtime by defining their own command-line arguments.
|
|
46
|
-
*
|
|
47
|
-
* @param args The command-line arguments passed to Burp Suite on startup.
|
|
48
|
-
*/
|
|
49
|
-
public void setCommandLineArgs(String[] args);
|
|
50
|
-
|
|
51
|
-
/**
|
|
52
|
-
* This method is invoked by Burp Proxy whenever a client request or server
|
|
53
|
-
* response is received. It allows implementations to perform logging
|
|
54
|
-
* functions, modify the message, specify an action (intercept, drop, etc.)
|
|
55
|
-
* and perform any other arbitrary processing.
|
|
56
|
-
*
|
|
57
|
-
* @param messageReference An identifier which is unique to a single
|
|
58
|
-
* request/response pair. This can be used to correlate details of requests
|
|
59
|
-
* and responses and perform processing on the response message accordingly.
|
|
60
|
-
* @param messageIsRequest Flags whether the message is a client request or
|
|
61
|
-
* a server response.
|
|
62
|
-
* @param remoteHost The hostname of the remote HTTP server.
|
|
63
|
-
* @param remotePort The port of the remote HTTP server.
|
|
64
|
-
* @param serviceIsHttps Flags whether the protocol is HTTPS or HTTP.
|
|
65
|
-
* @param httpMethod The method verb used in the client request.
|
|
66
|
-
* @param url The requested URL.
|
|
67
|
-
* @param resourceType The filetype of the requested resource, or a
|
|
68
|
-
* zero-length string if the resource has no filetype.
|
|
69
|
-
* @param statusCode The HTTP status code returned by the server. This value
|
|
70
|
-
* is <code>null</code> for request messages.
|
|
71
|
-
* @param responseContentType The content-type string returned by the
|
|
72
|
-
* server. This value is <code>null</code> for request messages.
|
|
73
|
-
* @param message The full HTTP message.
|
|
74
|
-
* @param action An array containing a single integer, allowing the
|
|
75
|
-
* implementation to communicate back to Burp Proxy a non-default
|
|
76
|
-
* interception action for the message. The default value is
|
|
77
|
-
* <code>ACTION_FOLLOW_RULES</code>. Set <code>action[0]</code> to one of
|
|
78
|
-
* the other possible values to perform a different action.
|
|
79
|
-
* @return Implementations should return either (a) the same object received
|
|
80
|
-
* in the <code>message</code> paramater, or (b) a different object
|
|
81
|
-
* containing a modified message.
|
|
82
|
-
*/
|
|
83
|
-
public byte[] processProxyMessage(
|
|
84
|
-
int messageReference,
|
|
85
|
-
boolean messageIsRequest,
|
|
86
|
-
String remoteHost,
|
|
87
|
-
int remotePort,
|
|
88
|
-
boolean serviceIsHttps,
|
|
89
|
-
String httpMethod,
|
|
90
|
-
String url,
|
|
91
|
-
String resourceType,
|
|
92
|
-
String statusCode,
|
|
93
|
-
String responseContentType,
|
|
94
|
-
byte[] message,
|
|
95
|
-
int[] action);
|
|
96
|
-
|
|
97
|
-
/**
|
|
98
|
-
* Causes Burp Proxy to follow the current interception rules to determine
|
|
99
|
-
* the appropriate action to take for the message.
|
|
100
|
-
*/
|
|
101
|
-
public final static int ACTION_FOLLOW_RULES = 0;
|
|
102
|
-
/**
|
|
103
|
-
* Causes Burp Proxy to present the message to the user for manual
|
|
104
|
-
* review or modification.
|
|
105
|
-
*/
|
|
106
|
-
public final static int ACTION_DO_INTERCEPT = 1;
|
|
107
|
-
/**
|
|
108
|
-
* Causes Burp Proxy to forward the message to the remote server or client.
|
|
109
|
-
*/
|
|
110
|
-
public final static int ACTION_DONT_INTERCEPT = 2;
|
|
111
|
-
/**
|
|
112
|
-
* Causes Burp Proxy to drop the message and close the client connection.
|
|
113
|
-
*/
|
|
114
|
-
public final static int ACTION_DROP = 3;
|
|
115
|
-
/**
|
|
116
|
-
* Causes Burp Proxy to follow the current interception rules to determine
|
|
117
|
-
* the appropriate action to take for the message, and then make a second
|
|
118
|
-
* call to processProxyMessage.
|
|
119
|
-
*/
|
|
120
|
-
public final static int ACTION_FOLLOW_RULES_AND_REHOOK = 0x10;
|
|
121
|
-
/**
|
|
122
|
-
* Causes Burp Proxy to present the message to the user for manual
|
|
123
|
-
* review or modification, and then make a second call to
|
|
124
|
-
* processProxyMessage.
|
|
125
|
-
*/
|
|
126
|
-
public final static int ACTION_DO_INTERCEPT_AND_REHOOK = 0x11;
|
|
127
|
-
/**
|
|
128
|
-
* Causes Burp Proxy to skip user interception, and then make a second call
|
|
129
|
-
* to processProxyMessage.
|
|
130
|
-
*/
|
|
131
|
-
public final static int ACTION_DONT_INTERCEPT_AND_REHOOK = 0x12;
|
|
132
|
-
|
|
133
|
-
/**
|
|
134
|
-
* This method is invoked on startup. It registers an instance of the
|
|
135
|
-
* <code>IBurpExtenderCallbacks</code> interface, providing methods that
|
|
136
|
-
* may be invoked by the implementation to perform various actions.
|
|
137
|
-
*
|
|
138
|
-
* The call to registerExtenderCallbacks need not return, and
|
|
139
|
-
* implementations may use the invoking thread for any purpose.<p>
|
|
140
|
-
*
|
|
141
|
-
* @param callbacks An implementation of the
|
|
142
|
-
* <code>IBurpExtenderCallbacks</code> interface.
|
|
143
|
-
*/
|
|
144
|
-
public void registerExtenderCallbacks(burp.IBurpExtenderCallbacks callbacks);
|
|
145
|
-
|
|
146
|
-
/**
|
|
147
|
-
* This method is invoked immediately before Burp Suite exits.
|
|
148
|
-
* It allows implementations to carry out any clean-up actions necessary
|
|
149
|
-
* (e.g. flushing log files or closing database resources).
|
|
150
|
-
*/
|
|
151
|
-
public void applicationClosing();
|
|
152
|
-
|
|
153
|
-
/**
|
|
154
|
-
* This method is invoked whenever any of Burp's tools makes an HTTP request
|
|
155
|
-
* or receives a response. It allows extensions to intercept and modify the
|
|
156
|
-
* HTTP traffic of all Burp tools. For each request, the method is invoked
|
|
157
|
-
* after the request has been fully processed by the invoking tool and is
|
|
158
|
-
* about to be made on the network. For each response, the method is invoked
|
|
159
|
-
* after the response has been received from the network and before any
|
|
160
|
-
* processing is performed by the invoking tool.
|
|
161
|
-
*
|
|
162
|
-
* @param toolName The name of the Burp tool which is making the request.
|
|
163
|
-
* @param messageIsRequest Indicates whether the message is a request or
|
|
164
|
-
* response.
|
|
165
|
-
* @param messageInfo Details of the HTTP message.
|
|
166
|
-
*/
|
|
167
|
-
public void processHttpMessage(
|
|
168
|
-
String toolName,
|
|
169
|
-
boolean messageIsRequest,
|
|
170
|
-
IHttpRequestResponse messageInfo);
|
|
171
|
-
|
|
172
|
-
/**
|
|
173
|
-
* This method is invoked whenever Burp Scanner discovers a new, unique
|
|
174
|
-
* issue, and can be used to perform customised reporting or logging of issues.
|
|
175
|
-
*
|
|
176
|
-
* @param issue Details of the new scan issue.
|
|
177
|
-
*/
|
|
178
|
-
public void newScanIssue(IScanIssue issue);
|
|
179
|
-
|
|
180
|
-
}
|
|
@@ -1,373 +0,0 @@
|
|
|
1
|
-
package burp;
|
|
2
|
-
|
|
3
|
-
import java.util.List;
|
|
4
|
-
import java.util.Map;
|
|
5
|
-
|
|
6
|
-
/*
|
|
7
|
-
* @(#)IBurpExtenderCallbacks.java
|
|
8
|
-
*
|
|
9
|
-
* Copyright PortSwigger Ltd. All rights reserved.
|
|
10
|
-
*
|
|
11
|
-
* This code may be used to extend the functionality of Burp Suite and Burp
|
|
12
|
-
* Suite Professional, provided that this usage does not violate the
|
|
13
|
-
* license terms for those products.
|
|
14
|
-
*/
|
|
15
|
-
|
|
16
|
-
/**
|
|
17
|
-
* This interface is used by Burp Suite to pass to implementations of the
|
|
18
|
-
* <code>IBurpExtender</code> interface a set of callback methods which can
|
|
19
|
-
* be used by implementations to perform various actions within Burp Suite.
|
|
20
|
-
*
|
|
21
|
-
* If an implementation of <code>IBurpExtender</code> is loaded then on startup
|
|
22
|
-
* Burp Suite will invoke the implementation's
|
|
23
|
-
* <code>registerExtenderCallbacks</code> method (if present) and pass to
|
|
24
|
-
* the implementation an instance of the <code>IBurpExtenderCallbacks</code>
|
|
25
|
-
* interface. The implementation may then invoke the methods of this instance
|
|
26
|
-
* as it sees fit in order to extend Burp Suite's functionality.<p>
|
|
27
|
-
*/
|
|
28
|
-
|
|
29
|
-
public interface IBurpExtenderCallbacks
|
|
30
|
-
{
|
|
31
|
-
/**
|
|
32
|
-
* This method can be used to issue arbitrary HTTP requests and retrieve
|
|
33
|
-
* their responses.
|
|
34
|
-
*
|
|
35
|
-
* @param host The hostname of the remote HTTP server.
|
|
36
|
-
* @param port The port of the remote HTTP server.
|
|
37
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
38
|
-
* @param request The full HTTP request.
|
|
39
|
-
* @return The full response retrieved from the remote server.
|
|
40
|
-
* @throws java.lang.Exception
|
|
41
|
-
*/
|
|
42
|
-
public byte[] makeHttpRequest(
|
|
43
|
-
String host,
|
|
44
|
-
int port,
|
|
45
|
-
boolean useHttps,
|
|
46
|
-
byte[] request) throws Exception;
|
|
47
|
-
|
|
48
|
-
/**
|
|
49
|
-
* This method can be used to send an HTTP request to the Burp Repeater
|
|
50
|
-
* tool. The request will be displayed in the user interface, but will not
|
|
51
|
-
* be issued until the user initiates this action.
|
|
52
|
-
*
|
|
53
|
-
* @param host The hostname of the remote HTTP server.
|
|
54
|
-
* @param port The port of the remote HTTP server.
|
|
55
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
56
|
-
* @param request The full HTTP request.
|
|
57
|
-
* @param tabCaption An optional caption which will appear on the Repeater
|
|
58
|
-
* tab containing the request. If this value is <code>null</code> then a
|
|
59
|
-
* default tab index will be displayed.
|
|
60
|
-
* @throws java.lang.Exception
|
|
61
|
-
*/
|
|
62
|
-
public void sendToRepeater(
|
|
63
|
-
String host,
|
|
64
|
-
int port,
|
|
65
|
-
boolean useHttps,
|
|
66
|
-
byte[] request,
|
|
67
|
-
String tabCaption) throws Exception;
|
|
68
|
-
|
|
69
|
-
/**
|
|
70
|
-
* This method can be used to send an HTTP request to the Burp Intruder
|
|
71
|
-
* tool. The request will be displayed in the user interface, and markers
|
|
72
|
-
* for attack payloads will be placed into default locations within the
|
|
73
|
-
* request.
|
|
74
|
-
*
|
|
75
|
-
* @param host The hostname of the remote HTTP server.
|
|
76
|
-
* @param port The port of the remote HTTP server.
|
|
77
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
78
|
-
* @param request The full HTTP request.
|
|
79
|
-
* @throws java.lang.Exception
|
|
80
|
-
*/
|
|
81
|
-
public void sendToIntruder(
|
|
82
|
-
String host,
|
|
83
|
-
int port,
|
|
84
|
-
boolean useHttps,
|
|
85
|
-
byte[] request) throws Exception;
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
/**
|
|
89
|
-
* This method can be used to send an HTTP request to the Burp Intruder
|
|
90
|
-
* tool. The request will be displayed in the user interface, and markers
|
|
91
|
-
* for attack payloads will be placed into the specified locations within
|
|
92
|
-
* the request.
|
|
93
|
-
*
|
|
94
|
-
* @param host The hostname of the remote HTTP server.
|
|
95
|
-
* @param port The port of the remote HTTP server.
|
|
96
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
97
|
-
* @param request The full HTTP request.
|
|
98
|
-
* @param payloadPositionOffsets A list of index pairs representing the
|
|
99
|
-
* payload positions to be used. Each item in the list must be an int[2]
|
|
100
|
-
* array containing the start and end offset for the payload position.
|
|
101
|
-
* @throws java.lang.Exception
|
|
102
|
-
*/
|
|
103
|
-
public void sendToIntruder(
|
|
104
|
-
String host,
|
|
105
|
-
int port,
|
|
106
|
-
boolean useHttps,
|
|
107
|
-
byte[] request,
|
|
108
|
-
List payloadPositionOffsets) throws Exception;
|
|
109
|
-
|
|
110
|
-
/**
|
|
111
|
-
* This method can be used to send a seed URL to the Burp Spider tool. If
|
|
112
|
-
* the URL is not within the current Spider scope, the user will be asked
|
|
113
|
-
* if they wish to add the URL to the scope. If the Spider is not currently
|
|
114
|
-
* running, it will be started. The seed URL will be requested, and the
|
|
115
|
-
* Spider will process the application's response in the normal way.
|
|
116
|
-
*
|
|
117
|
-
* @param url The new seed URL to begin spidering from.
|
|
118
|
-
* @throws java.lang.Exception
|
|
119
|
-
*/
|
|
120
|
-
public void sendToSpider(
|
|
121
|
-
java.net.URL url) throws Exception;
|
|
122
|
-
|
|
123
|
-
/**
|
|
124
|
-
* This method can be used to send an HTTP request to the Burp Scanner
|
|
125
|
-
* tool to perform an active vulnerability scan. If the request is not
|
|
126
|
-
* within the current active scanning scope, the user will be asked if
|
|
127
|
-
* they wish to proceed with the scan.
|
|
128
|
-
*
|
|
129
|
-
* @param host The hostname of the remote HTTP server.
|
|
130
|
-
* @param port The port of the remote HTTP server.
|
|
131
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
132
|
-
* @param request The full HTTP request.
|
|
133
|
-
* @return The resulting scan queue item.
|
|
134
|
-
* @throws java.lang.Exception
|
|
135
|
-
*/
|
|
136
|
-
public IScanQueueItem doActiveScan(
|
|
137
|
-
String host,
|
|
138
|
-
int port,
|
|
139
|
-
boolean useHttps,
|
|
140
|
-
byte[] request) throws Exception;
|
|
141
|
-
|
|
142
|
-
/**
|
|
143
|
-
* This method can be used to send an HTTP request to the Burp Scanner
|
|
144
|
-
* tool to perform an active vulnerability scan, based on a custom list
|
|
145
|
-
* of insertion points that are to be scanned. If the request is not
|
|
146
|
-
* within the current active scanning scope, the user will be asked if
|
|
147
|
-
* they wish to proceed with the scan.
|
|
148
|
-
*
|
|
149
|
-
* @param host The hostname of the remote HTTP server.
|
|
150
|
-
* @param port The port of the remote HTTP server.
|
|
151
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
152
|
-
* @param request The full HTTP request.
|
|
153
|
-
* @param insertionPointOffsets A list of index pairs representing the
|
|
154
|
-
* positions of the insertion points that should be scanned. Each item in
|
|
155
|
-
* the list must be an int[2] array containing the start and end offsets
|
|
156
|
-
* for the insertion point.
|
|
157
|
-
* @return The resulting scan queue item.
|
|
158
|
-
* @throws java.lang.Exception
|
|
159
|
-
*/
|
|
160
|
-
public IScanQueueItem doActiveScan(
|
|
161
|
-
String host,
|
|
162
|
-
int port,
|
|
163
|
-
boolean useHttps,
|
|
164
|
-
byte[] request,
|
|
165
|
-
List<int[]> insertionPointOffsets) throws Exception;
|
|
166
|
-
|
|
167
|
-
/**
|
|
168
|
-
* This method can be used to send an HTTP request to the Burp Scanner
|
|
169
|
-
* tool to perform a passive vulnerability scan.
|
|
170
|
-
*
|
|
171
|
-
* @param host The hostname of the remote HTTP server.
|
|
172
|
-
* @param port The port of the remote HTTP server.
|
|
173
|
-
* @param useHttps Flags whether the protocol is HTTPS or HTTP.
|
|
174
|
-
* @param request The full HTTP request.
|
|
175
|
-
* @param response The full HTTP response.
|
|
176
|
-
* @throws java.lang.Exception
|
|
177
|
-
*/
|
|
178
|
-
public void doPassiveScan(
|
|
179
|
-
String host,
|
|
180
|
-
int port,
|
|
181
|
-
boolean useHttps,
|
|
182
|
-
byte[] request,
|
|
183
|
-
byte[] response) throws Exception;
|
|
184
|
-
|
|
185
|
-
/**
|
|
186
|
-
* This method can be used to query whether a specified URL is within
|
|
187
|
-
* the current Suite-wide scope.
|
|
188
|
-
*
|
|
189
|
-
* @param url The URL to query.
|
|
190
|
-
* @return Returns <code>true</code> if the URL is within the current
|
|
191
|
-
* Suite-wide scope.
|
|
192
|
-
* @throws java.lang.Exception
|
|
193
|
-
*/
|
|
194
|
-
boolean isInScope(java.net.URL url) throws Exception;
|
|
195
|
-
|
|
196
|
-
/**
|
|
197
|
-
* This method can be used to include the specified URL in the Suite-wide
|
|
198
|
-
* scope.
|
|
199
|
-
*
|
|
200
|
-
* @param url The URL to include in the Suite-wide scope.
|
|
201
|
-
* @throws java.lang.Exception
|
|
202
|
-
*/
|
|
203
|
-
void includeInScope(java.net.URL url) throws Exception;
|
|
204
|
-
|
|
205
|
-
/**
|
|
206
|
-
* This method can be used to exclude the specified URL from the Suite-wide
|
|
207
|
-
* scope.
|
|
208
|
-
*
|
|
209
|
-
* @param url The URL to exclude from the Suite-wide scope.
|
|
210
|
-
* @throws java.lang.Exception
|
|
211
|
-
*/
|
|
212
|
-
void excludeFromScope(java.net.URL url) throws Exception;
|
|
213
|
-
|
|
214
|
-
/**
|
|
215
|
-
* This method can be used to display a specified message in the Burp
|
|
216
|
-
* Suite alerts tab.
|
|
217
|
-
*
|
|
218
|
-
* @param message The alert message to display.
|
|
219
|
-
*/
|
|
220
|
-
public void issueAlert(String message);
|
|
221
|
-
|
|
222
|
-
/**
|
|
223
|
-
* This method returns details of all items in the proxy history.
|
|
224
|
-
*
|
|
225
|
-
* @return The contents of the proxy history.
|
|
226
|
-
*/
|
|
227
|
-
public IHttpRequestResponse[] getProxyHistory();
|
|
228
|
-
|
|
229
|
-
/**
|
|
230
|
-
* This method returns details of items in the site map.
|
|
231
|
-
*
|
|
232
|
-
* @param urlPrefix This parameter can be used to specify a URL prefix, in
|
|
233
|
-
* order to extract a specific subset of the site map. The method performs
|
|
234
|
-
* a simple case-sensitive text match, returning all site
|
|
235
|
-
* map items whose URL begins with the specified prefix. If this parameter
|
|
236
|
-
* is null, the entire site map is returned.
|
|
237
|
-
* @return Details of items in the site map.
|
|
238
|
-
*/
|
|
239
|
-
public IHttpRequestResponse[] getSiteMap(String urlPrefix);
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
/**
|
|
243
|
-
* This method can be used to add an item to Burp's site map with the
|
|
244
|
-
* specified request/response details. This will overwrite the details
|
|
245
|
-
* of any existing matching item in the site map.
|
|
246
|
-
*
|
|
247
|
-
* @param item Details of the item to be added to the site map
|
|
248
|
-
*/
|
|
249
|
-
public void addToSiteMap(IHttpRequestResponse item);
|
|
250
|
-
|
|
251
|
-
/**
|
|
252
|
-
* This method can be used to restore Burp's state from a specified
|
|
253
|
-
* saved state file. This method blocks until the restore operation is
|
|
254
|
-
* completed, and must not be called from the event thread.
|
|
255
|
-
*
|
|
256
|
-
* @param file The file containing Burp's saved state.
|
|
257
|
-
* @throws java.lang.Exception
|
|
258
|
-
*/
|
|
259
|
-
public void restoreState(java.io.File file) throws Exception;
|
|
260
|
-
|
|
261
|
-
/**
|
|
262
|
-
* This method can be used to save Burp's state to a specified file.
|
|
263
|
-
* This method blocks until the save operation is completed, and must not be
|
|
264
|
-
* called from the event thread.
|
|
265
|
-
*
|
|
266
|
-
* @param file The file to save Burp's state in.
|
|
267
|
-
* @throws java.lang.Exception
|
|
268
|
-
*/
|
|
269
|
-
public void saveState(java.io.File file) throws Exception;
|
|
270
|
-
|
|
271
|
-
/**
|
|
272
|
-
* This method parses the specified request and returns details of each
|
|
273
|
-
* request parameter.
|
|
274
|
-
*
|
|
275
|
-
* @param request The request to be parsed.
|
|
276
|
-
* @return An array of:
|
|
277
|
-
* <code>String[] { name, value, type }</code>
|
|
278
|
-
* containing details of the parameters contained within the request.
|
|
279
|
-
* @throws java.lang.Exception
|
|
280
|
-
*/
|
|
281
|
-
public String[][] getParameters(byte[] request) throws Exception;
|
|
282
|
-
|
|
283
|
-
/**
|
|
284
|
-
* This method parses the specified request and returns details of each
|
|
285
|
-
* HTTP header.
|
|
286
|
-
*
|
|
287
|
-
* @param message The request to be parsed.
|
|
288
|
-
* @return An array of HTTP headers.
|
|
289
|
-
* @throws java.lang.Exception
|
|
290
|
-
*/
|
|
291
|
-
public String[] getHeaders(byte[] message) throws Exception;
|
|
292
|
-
|
|
293
|
-
/**
|
|
294
|
-
* This method returns all of the current scan issues for URLs matching the
|
|
295
|
-
* specified literal prefix.
|
|
296
|
-
*
|
|
297
|
-
* @param urlPrefix This parameter can be used to specify a URL prefix, in
|
|
298
|
-
* order to extract a specific subset of scan issues. The method performs
|
|
299
|
-
* a simple case-sensitive text match, returning all scan issues whose URL
|
|
300
|
-
* begins with the specified prefix. If this parameter is null, all issues
|
|
301
|
-
* are returned.
|
|
302
|
-
* @return Details of the scan issues.
|
|
303
|
-
*/
|
|
304
|
-
public IScanIssue[] getScanIssues(String urlPrefix);
|
|
305
|
-
|
|
306
|
-
/**
|
|
307
|
-
*
|
|
308
|
-
* This method can be used to register a new menu item which will appear
|
|
309
|
-
* on the various context menus that are used throughout Burp Suite to
|
|
310
|
-
* handle user-driven actions.
|
|
311
|
-
*
|
|
312
|
-
* @param menuItemCaption The caption to be displayed on the menu item.
|
|
313
|
-
* @param menuItemHandler The handler to be invoked when the user clicks
|
|
314
|
-
* on the menu item.
|
|
315
|
-
*/
|
|
316
|
-
public void registerMenuItem(
|
|
317
|
-
String menuItemCaption,
|
|
318
|
-
IMenuItemHandler menuItemHandler);
|
|
319
|
-
|
|
320
|
-
/**
|
|
321
|
-
*
|
|
322
|
-
* This method causes Burp to save all of its current configuration as a
|
|
323
|
-
* Map of name/value Strings.
|
|
324
|
-
*
|
|
325
|
-
* @return A Map of name/value Strings reflecting Burp's current
|
|
326
|
-
* configuration.
|
|
327
|
-
*/
|
|
328
|
-
public Map saveConfig();
|
|
329
|
-
|
|
330
|
-
/**
|
|
331
|
-
*
|
|
332
|
-
* This method causes Burp to load a new configuration from the Map of
|
|
333
|
-
* name/value Strings provided. Any settings not specified in the Map will
|
|
334
|
-
* be restored to their default values. To selectively update only some
|
|
335
|
-
* settings and leave the rest unchanged, you should first call
|
|
336
|
-
* <code>saveConfig</code> to obtain Burp's current configuration, modify
|
|
337
|
-
* the relevant items in the Map, and then call <code>loadConfig</code>
|
|
338
|
-
* with the same Map.
|
|
339
|
-
*
|
|
340
|
-
* @param config A map of name/value Strings to use as Burp's new
|
|
341
|
-
* configuration.
|
|
342
|
-
*/
|
|
343
|
-
public void loadConfig(Map config);
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
/**
|
|
347
|
-
*
|
|
348
|
-
* This method sets the interception mode for Burp Proxy.
|
|
349
|
-
*
|
|
350
|
-
* @param enabled Indicates whether interception of proxy messages should
|
|
351
|
-
* be enabled.
|
|
352
|
-
*/
|
|
353
|
-
public void setProxyInterceptionEnabled(boolean enabled);
|
|
354
|
-
|
|
355
|
-
|
|
356
|
-
/**
|
|
357
|
-
* This method can be used to shut down Burp programmatically, with an
|
|
358
|
-
* optional prompt to the user. If the method returns, the user cancelled
|
|
359
|
-
* the shutdown prompt.
|
|
360
|
-
*
|
|
361
|
-
* @param promptUser Indicates whether to prompt the user to confirm the
|
|
362
|
-
* shutdown.
|
|
363
|
-
*/
|
|
364
|
-
public void exitSuite(boolean promptUser);
|
|
365
|
-
|
|
366
|
-
/**
|
|
367
|
-
* This method can be used to determine the version of the loaded burp at runtime.
|
|
368
|
-
* This is included in the Javadoc for the extension interfaces but not the supplied interface files.
|
|
369
|
-
* @return String array containing the product name, major version, and minor version.
|
|
370
|
-
*/
|
|
371
|
-
public String[] getBurpVersion();
|
|
372
|
-
|
|
373
|
-
}
|