buby 1.3.3-java → 1.5.0-java

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (109) hide show
  1. data/README.rdoc +28 -14
  2. data/Rakefile +96 -6
  3. data/VERSION.yml +5 -0
  4. data/bin/buby +2 -0
  5. data/buby.gemspec +102 -17
  6. data/{java/src → ext/buby/burp}/BurpExtender.java +189 -29
  7. data/ext/burp_interfaces/burp/IBurpExtender.java +31 -0
  8. data/ext/burp_interfaces/burp/IBurpExtenderCallbacks.java +785 -0
  9. data/ext/burp_interfaces/burp/IContextMenuFactory.java +38 -0
  10. data/ext/burp_interfaces/burp/IContextMenuInvocation.java +156 -0
  11. data/ext/burp_interfaces/burp/ICookie.java +53 -0
  12. data/ext/burp_interfaces/burp/IExtensionHelpers.java +352 -0
  13. data/ext/burp_interfaces/burp/IExtensionStateListener.java +27 -0
  14. data/ext/burp_interfaces/burp/IHttpListener.java +37 -0
  15. data/ext/burp_interfaces/burp/IHttpRequestResponse.java +102 -0
  16. data/ext/burp_interfaces/burp/IHttpRequestResponsePersisted.java +26 -0
  17. data/ext/burp_interfaces/burp/IHttpRequestResponseWithMarkers.java +44 -0
  18. data/ext/burp_interfaces/burp/IHttpService.java +39 -0
  19. data/ext/burp_interfaces/burp/IInterceptedProxyMessage.java +116 -0
  20. data/ext/burp_interfaces/burp/IIntruderAttack.java +31 -0
  21. data/ext/burp_interfaces/burp/IIntruderPayloadGenerator.java +50 -0
  22. data/ext/burp_interfaces/burp/IIntruderPayloadGeneratorFactory.java +40 -0
  23. data/ext/burp_interfaces/burp/IIntruderPayloadProcessor.java +45 -0
  24. data/{java/src → ext/burp_interfaces}/burp/IMenuItemHandler.java +36 -40
  25. data/ext/burp_interfaces/burp/IMessageEditor.java +64 -0
  26. data/ext/burp_interfaces/burp/IMessageEditorController.java +49 -0
  27. data/ext/burp_interfaces/burp/IMessageEditorTab.java +102 -0
  28. data/ext/burp_interfaces/burp/IMessageEditorTabFactory.java +38 -0
  29. data/ext/burp_interfaces/burp/IParameter.java +104 -0
  30. data/ext/burp_interfaces/burp/IProxyListener.java +37 -0
  31. data/ext/burp_interfaces/burp/IRequestInfo.java +95 -0
  32. data/ext/burp_interfaces/burp/IResponseInfo.java +54 -0
  33. data/ext/burp_interfaces/burp/IScanIssue.java +120 -0
  34. data/ext/burp_interfaces/burp/IScanQueueItem.java +80 -0
  35. data/ext/burp_interfaces/burp/IScannerCheck.java +89 -0
  36. data/ext/burp_interfaces/burp/IScannerInsertionPoint.java +156 -0
  37. data/ext/burp_interfaces/burp/IScannerInsertionPointProvider.java +38 -0
  38. data/ext/burp_interfaces/burp/IScannerListener.java +30 -0
  39. data/ext/burp_interfaces/burp/IScopeChangeListener.java +25 -0
  40. data/ext/burp_interfaces/burp/ISessionHandlingAction.java +51 -0
  41. data/ext/burp_interfaces/burp/ITab.java +38 -0
  42. data/ext/burp_interfaces/burp/ITempFile.java +33 -0
  43. data/ext/burp_interfaces/burp/ITextEditor.java +90 -0
  44. data/lib/buby/burp_extender/console_frame.rb +33 -0
  45. data/lib/buby/burp_extender/console_pane.rb +26 -0
  46. data/lib/buby/burp_extender/console_tab.rb +15 -0
  47. data/lib/buby/burp_extender/context_menu.rb +29 -0
  48. data/lib/buby/burp_extender/context_menu_factory.rb +17 -0
  49. data/lib/buby/burp_extender/context_menu_item.rb +13 -0
  50. data/lib/buby/burp_extender/jcheck_box_menu_item.rb +12 -0
  51. data/lib/buby/burp_extender/jmenu.rb +11 -0
  52. data/lib/buby/burp_extender/jmenu_item.rb +12 -0
  53. data/lib/buby/burp_extender/menu.rb +11 -0
  54. data/lib/buby/burp_extender/menu_item.rb +12 -0
  55. data/lib/buby/burp_extender.rb +339 -0
  56. data/lib/buby/context_menu_factory.rb +35 -0
  57. data/lib/buby/cookie.rb +37 -0
  58. data/lib/buby/extender.rb +156 -0
  59. data/lib/buby/http_listener.rb +29 -0
  60. data/lib/buby/{extends → implants}/buby_array_wrapper.rb +0 -0
  61. data/lib/buby/implants/context_menu_invocation.rb +113 -0
  62. data/lib/buby/implants/cookie.rb +47 -0
  63. data/lib/buby/implants/extension_helpers.rb +286 -0
  64. data/lib/buby/{extends → implants}/http_request_response.rb +8 -1
  65. data/lib/buby/implants/intercepted_proxy_message.rb +53 -0
  66. data/lib/buby/implants/intruder_attack.rb +42 -0
  67. data/lib/buby/implants/jruby.rb +64 -0
  68. data/lib/buby/implants/message_editor.rb +70 -0
  69. data/lib/buby/implants/message_editor_controller.rb +60 -0
  70. data/lib/buby/implants/parameter.rb +84 -0
  71. data/lib/buby/implants/request_info.rb +47 -0
  72. data/lib/buby/implants/response_info.rb +44 -0
  73. data/lib/buby/{extends → implants}/scan_issue.rb +1 -2
  74. data/lib/buby/implants/scan_queue_item.rb +53 -0
  75. data/lib/buby/implants/scanner_insertion_point.rb +92 -0
  76. data/lib/buby/implants/temp_file.rb +43 -0
  77. data/lib/buby/implants/text_editor.rb +63 -0
  78. data/lib/buby/implants.rb +28 -0
  79. data/lib/buby/intruder_payload_generator.rb +60 -0
  80. data/lib/buby/intruder_payload_generator_factory.rb +32 -0
  81. data/lib/buby/intruder_payload_processor.rb +38 -0
  82. data/lib/buby/message_editor_controller.rb +41 -0
  83. data/lib/buby/message_editor_tab.rb +98 -0
  84. data/lib/buby/message_editor_tab_factory.rb +28 -0
  85. data/lib/buby/parameter/base.rb +40 -0
  86. data/lib/buby/parameter/body.rb +7 -0
  87. data/lib/buby/parameter/cookie.rb +7 -0
  88. data/lib/buby/parameter/url.rb +7 -0
  89. data/lib/buby/parameter.rb +15 -0
  90. data/lib/buby/proxy_listener.rb +26 -0
  91. data/lib/buby/scan_issue.rb +112 -0
  92. data/lib/buby/scanner_check.rb +84 -0
  93. data/lib/buby/scanner_insertion_point.rb +118 -0
  94. data/lib/buby/scanner_insertion_point_provider.rb +27 -0
  95. data/lib/buby/scanner_listener.rb +22 -0
  96. data/lib/buby/scope_change_listener.rb +19 -0
  97. data/lib/buby/session_handling_action.rb +43 -0
  98. data/lib/buby/tab.rb +37 -0
  99. data/lib/buby/version.rb +9 -0
  100. data/lib/buby.rb +892 -101
  101. metadata +118 -22
  102. data/VERSION +0 -1
  103. data/java/buby.jar +0 -0
  104. data/java/src/burp/IBurpExtender.java +0 -180
  105. data/java/src/burp/IBurpExtenderCallbacks.java +0 -373
  106. data/java/src/burp/IHttpRequestResponse.java +0 -156
  107. data/java/src/burp/IScanIssue.java +0 -106
  108. data/java/src/burp/IScanQueueItem.java +0 -76
  109. data/lib/buby/extends.rb +0 -4
@@ -0,0 +1,35 @@
1
+ class Buby
2
+ # Extensions can implement this interface and then call
3
+ # <code>IBurpExtenderCallbacks.registerContextMenuFactory()</code> to register
4
+ # a factory for custom context menu items.
5
+ #
6
+ class ContextMenuFactory
7
+ include Java::Burp::IContextMenuFactory
8
+
9
+ # This method will be called by Burp when the user invokes a context menu
10
+ # anywhere within Burp. The factory can then provide any custom context
11
+ # menu items that should be displayed in the context menu, based on the
12
+ # details of the menu invocation.
13
+ # Implementations should call super
14
+ #
15
+ # @param [IContextMenuInvocation] invocation An object the extension can
16
+ # query to obtain details of the context menu invocation.
17
+ # @return [Array<JMenuItem>] A list of custom menu items (which may include
18
+ # sub-menus, checkbox menu items, etc.) that should be displayed.
19
+ # Extensions may return +nil+ from this method, to indicate that no menu
20
+ # items are required.
21
+ #
22
+ def self.createMenuItems invocation
23
+ pp [:got_create_menu_items, invocation] if $DEBUG
24
+ Buby::Implants::ContextMenuInvocation.implant invocation
25
+ nil
26
+ end
27
+
28
+ # (see ContextMenuFactory.createMenuItems)
29
+ def createMenuItems invocation
30
+ pp [:got_create_menu_items, invocation] if $DEBUG
31
+ Buby::Implants::ContextMenuInvocation.implant invocation
32
+ nil
33
+ end
34
+ end
35
+ end
@@ -0,0 +1,37 @@
1
+ require 'cgi'
2
+
3
+ class Buby
4
+ # This class is used to hold details about an HTTP cookie. Implements the
5
+ # +burp.ICookie+ interface
6
+ #
7
+ class Cookie < CGI::Cookie
8
+ include Java::Burp::ICookie
9
+
10
+ # This method is used to retrieve the domain for which the cookie is in
11
+ # scope.
12
+ #
13
+ # @return [String] The domain for which the cookie is in scope.
14
+ def getDomain
15
+ @domain
16
+ end
17
+
18
+ # This method is used to retrieve the expiration time for the cookie.
19
+ #
20
+ # @return [java.util.Date] The expiration time for the cookie, or +nil+ if
21
+ # none is set (i.e., for non-persistent session cookies).
22
+ #
23
+ def getExpiration; @expires; end
24
+
25
+ # This method is used to retrieve the name of the cookie.
26
+ #
27
+ # @return [String] The name of the cookie.
28
+ #
29
+ def getName; @name; end
30
+
31
+ # This method is used to retrieve the value of the cookie.
32
+ #
33
+ # @return [String] The value of the cookie.
34
+ #
35
+ def getValue; join("&"); end
36
+ end
37
+ end
@@ -0,0 +1,156 @@
1
+ class Buby
2
+ # This is the JRuby implementation of IBurpExtender for use as a JRuby
3
+ # extension. This class handles the type conversions and other ruby sugar.
4
+ # {BurpExtender} further extends this by adding additional things during
5
+ # startup, like setting up Buby as the handler class and starting console
6
+ # tabs.
7
+ #
8
+ # @note This class, unlike the Java implementation, does not fire the
9
+ # deprecated evt_* callbacks, only the new versions.
10
+ #
11
+ # @todo move implant logic to extender interfaces
12
+ module Extender
13
+ include Java::Burp::IBurpExtender
14
+ include Java::Burp::IExtensionStateListener
15
+ include Java::Burp::IProxyListener
16
+ include Java::Burp::IHttpListener
17
+ include Java::Burp::IScannerListener
18
+ include Java::Burp::IScopeChangeListener
19
+ include Java::Burp::IContextMenuFactory
20
+
21
+ # @group Buby internals
22
+ # Internal reference to ruby handler class (usually {Buby})
23
+ @@handler = nil
24
+
25
+ # Returns the internal Ruby handler reference.
26
+ #
27
+ # The handler is the ruby class or module used for proxying BurpExtender
28
+ # events into a ruby runtime. Usually, this is Buby or a subclass.
29
+ #
30
+ def self.handler
31
+ @@handler
32
+ end
33
+
34
+ # Sets an internal reference to the ruby handler class or module to use for
35
+ # proxied BurpExtender events into a ruby runtime.
36
+ #
37
+ # Generally, this should probably be called in {#registerExtenderCallbacks}.
38
+ # However, it is also possible to set this afterwards and even swap in new
39
+ # objects during runtime.
40
+ #
41
+ def self.handler=(hndlr)
42
+ @@handler = hndlr
43
+ end
44
+
45
+ def handler
46
+ @@handler
47
+ end
48
+
49
+ def handler= hndlr
50
+ @@handler = hndlr
51
+ end
52
+
53
+ # @group Burp extender
54
+ # This callback usually fires before the handler is set.
55
+ #
56
+ def initialize *args
57
+ @@handler.extender_initialize(*args) if @@handler.respond_to? :extender_inititialize
58
+ end
59
+
60
+ # This method is invoked when the extension is loaded. It registers an
61
+ # instance of the +IBurpExtenderCallbacks+ interface, providing methods that
62
+ # may be invoked by the extension to perform various actions.
63
+ #
64
+ # @param [IBurpExtenderCallbacks] callbacks Burp's Java object for querying
65
+ # Burp's data.
66
+ # @return [void]
67
+ #
68
+ def registerExtenderCallbacks(callbacks)
69
+ @callbacks = callbacks
70
+ callbacks.issueAlert("[#{self.class}] registering JRuby handler callbacks")
71
+ callbacks.registerExtensionStateListener(self)
72
+ callbacks.registerHttpListener(self)
73
+ callbacks.registerScannerListener(self)
74
+ callbacks.registerContextMenuFactory self
75
+ callbacks.registerScopeChangeListener self
76
+ @@handler.register_callbacks(callbacks) if @@handler.respond_to? :register_callbacks
77
+ end
78
+
79
+ # @group Listeners
80
+ # This method is called when the extension is unloaded. This, in turn, calls
81
+ # {Buby#extension_unloaded} on the handler instance
82
+ #
83
+ def extensionUnloaded
84
+ @@handler.extension_unloaded if @@handler.respond_to? :extension_unloaded
85
+ end
86
+
87
+ # This method is invoked when an HTTP message is being processed by the
88
+ # Proxy and calls {Buby#process_proxy_message} on the handler.
89
+ #
90
+ # @param [Boolean] messageIsRequest Indicates whether the HTTP message is a
91
+ # request or a response.
92
+ # @param [IInterceptedProxyMessage] message An +IInterceptedProxyMessage+
93
+ # object that extensions can use to query and update details of the
94
+ # message, and control whether the message should be intercepted and
95
+ # displayed to the user for manual review or modification.
96
+ # @return [void]
97
+ #
98
+ def processProxyMessage(messageIsRequest, message)
99
+ @@handler.process_proxy_message(messageIsRequest, message) if @@handler.respond_to? :process_proxy_message
100
+ end
101
+
102
+ # This method is invoked when an HTTP request is about to be issued, and
103
+ # when an HTTP response has been received.
104
+ #
105
+ # @param [Fixnum] toolFlag A flag indicating the Burp tool that issued the
106
+ # request. Burp tool flags are defined in the +IBurpExtenderCallbacks+
107
+ # interface.
108
+ # @param [Boolean] messageIsRequest Flags whether the method is being
109
+ # invoked for a request or response.
110
+ # @param [IHttpRequestResponse] messageInfo Details of the request /
111
+ # response to be processed. Extensions can call the setter methods on this
112
+ # object to update the current message and so modify Burp's behavior.
113
+ # @return [void]
114
+ #
115
+ def processHttpMessage(toolFlag, messageIsRequest, messageInfo)
116
+ @@handler.process_http_message(toolFlag, messageIsRequest, messageInfo) if @@handler.respond_to? :process_http_message
117
+ end
118
+
119
+ # This method is invoked when a new issue is added to Burp Scanner's
120
+ # results.
121
+ #
122
+ # @param [IScanIssue] issue An +IScanIssue+ object that the extension can
123
+ # query to obtain details about the new issue.
124
+ #
125
+ def newScanIssue(issue)
126
+ @@handler.new_scan_issue(issue) if @@handler.respond_to? :new_scan_issue
127
+ end
128
+
129
+ # This method will be called by Burp when the user invokes a context menu
130
+ # anywhere within Burp. The factory can then provide any custom context menu
131
+ # items that should be displayed in the context menu, based on the details
132
+ # of the menu invocation.
133
+ #
134
+ # @param [IContextMenuInvocation] invocation An object the extension can
135
+ # query to obtain details of the context menu invocation.
136
+ # @return [Array<JMenuItem>, nil] A list of custom menu items (which may
137
+ # include sub-menus, checkbox menu items, etc.) that should be displayed.
138
+ # Extensions may return +nil+ from this method, to indicate that no menu
139
+ # items are required.
140
+ #
141
+ # @abstract
142
+ def createMenuItems invocation
143
+ @@handler.create_menu_items(invocation) if @@handler.respond_to? :create_menu_items
144
+ end
145
+
146
+ # This method is invoked whenever a change occurs to Burp's suite-wide
147
+ # target scope.
148
+ #
149
+ # @return [void]
150
+ #
151
+ # @abstract
152
+ def scopeChanged
153
+ @@handler.scope_changed if @@handler.respond_to? :scope_changed
154
+ end
155
+ end
156
+ end
@@ -0,0 +1,29 @@
1
+ class Buby
2
+ # Extensions can implement this interface and then call
3
+ # {Buby#registerHttpListener} to register an HTTP listener. The listener will
4
+ # be notified of requests and responses made by any Burp tool. Extensions can
5
+ # perform custom analysis or modification of these messages by registering an
6
+ # HTTP listener.
7
+ #
8
+ class HttpListener
9
+ include Java::Burp::IHttpListener
10
+
11
+ # This method is invoked when an HTTP request is about to be issued, and
12
+ # when an HTTP response has been received.
13
+ #
14
+ # @param [Fixnum, Symbol] toolFlag A flag indicating the Burp tool that
15
+ # issued the request. Burp tool flags are defined in the
16
+ # +IBurpExtenderCallbacks+ interface and {Buby}.
17
+ # @param [Boolean] messageIsRequest Flags whether the method is being
18
+ # invoked for a request or response.
19
+ # @param [IHttpRequestResponse] messageInfo Details of the request/response
20
+ # to be processed. Extensions can call the setter methods on this object
21
+ # to update the current message and so modify Burp's behavior.
22
+ #
23
+ # @todo move HttpRequestResponse to new implant scheme
24
+ def processHttpMessage(toolFlag, messageIsRequest, messageInfo)
25
+ pp [:got_processHttpMessage, toolFlag, messageIsRequest, messageInfo] if $DEBUG
26
+ Buby::HttpRequestResponseHelper.implant(messageInfo)
27
+ end
28
+ end
29
+ end
@@ -0,0 +1,113 @@
1
+ class Buby
2
+ module Implants
3
+ # This interface is used when Burp calls into an extension-provided
4
+ # <code>IContextMenuFactory</code> with details of a context menu
5
+ # invocation. The custom context menu factory can query this interface to
6
+ # obtain details of the invocation event, in order to determine what menu
7
+ # items should be displayed.
8
+ # This module is used to extend the JRuby proxy class returned by Burp.
9
+ #
10
+ module ContextMenuInvocation
11
+ # Context menu is being invoked in a request editor.
12
+ CONTEXT_MESSAGE_EDITOR_REQUEST = 0;
13
+
14
+ # Context menu is being invoked in a response editor.
15
+ CONTEXT_MESSAGE_EDITOR_RESPONSE = 1;
16
+
17
+ # Context menu is being invoked in a non-editable request viewer.
18
+ CONTEXT_MESSAGE_VIEWER_REQUEST = 2;
19
+
20
+ # Context menu is being invoked in a non-editable response viewer.
21
+ CONTEXT_MESSAGE_VIEWER_RESPONSE = 3;
22
+
23
+ # Context menu is being invoked in the Target site map tree.
24
+ CONTEXT_TARGET_SITE_MAP_TREE = 4;
25
+
26
+ # Context menu is being invoked in the Target site map table.
27
+ CONTEXT_TARGET_SITE_MAP_TABLE = 5;
28
+
29
+ # Context menu is being invoked in the Proxy history.
30
+ CONTEXT_PROXY_HISTORY = 6;
31
+
32
+ # Context menu is being invoked in the Scanner results.
33
+ CONTEXT_SCANNER_RESULTS = 7;
34
+
35
+ # Context menu is being invoked in the Intruder payload positions editor.
36
+ CONTEXT_INTRUDER_PAYLOAD_POSITIONS = 8;
37
+
38
+ # Context menu is being invoked in an Intruder attack results.
39
+ CONTEXT_INTRUDER_ATTACK_RESULTS = 9;
40
+
41
+ # Context menu is being invoked in a search results window.
42
+ CONTEXT_SEARCH_RESULTS = 10;
43
+
44
+ # This method can be used to retrieve details of the HTTP requests /
45
+ # responses that were shown or selected by the user when the context menu
46
+ # was invoked.
47
+ #
48
+ # @note For performance reasons, the objects returned from this method are
49
+ # tied to the originating context of the messages within the Burp UI.
50
+ # For example, if a context menu is invoked on the Proxy intercept
51
+ # panel, then the +IHttpRequestResponse+ returned by this method will
52
+ # reflect the current contents of the interception panel, and this will
53
+ # change when the current message has been forwarded or dropped. If your
54
+ # extension needs to store details of the message for which the context
55
+ # menu has been invoked, then you should query those details from the
56
+ # +IHttpRequestResponse+ at the time of invocation, or you should use
57
+ # +IBurpExtenderCallbacks.saveBuffersToTempFiles()+ to create a
58
+ # persistent read-only copy of the +IHttpRequestResponse+.
59
+ #
60
+ # @return [Array<IHttpRequestResponse>,nil] An array of objects
61
+ # representing the items that were shown or selected by the user when
62
+ # the context menu was invoked. This method returns +nil+ if no messages
63
+ # are applicable to the invocation.
64
+ #
65
+ def getSelectedMessages
66
+ pp [:got_get_selected_messages] if $DEBUG
67
+ hrrl = __getSelectedMessages
68
+ HttpRequestResponseHelper.implant(hrrl.first)
69
+ hrrl
70
+ end
71
+
72
+ # This method can be used to retrieve details of the Scanner issues that
73
+ # were selected by the user when the context menu was invoked.
74
+ #
75
+ # @return [Array<IScanIssue>,nil] The issues that were selected by the
76
+ # user when the context menu was invoked. This method returns +nil+ if
77
+ # no Scanner issues are applicable to the invocation.
78
+ #
79
+ def getSelectedIssues
80
+ pp [:got_get_selected_issues] if $DEBUG
81
+ sil = __getSelectedIssues
82
+ ScanIssueHelper.implant(sil.first)
83
+ sil
84
+ end
85
+
86
+ # Install ourselves into the current +IContextMenuInvocation+ java class
87
+ # @param [IContextMenuInvocation] invocation
88
+ #
89
+ def self.implant(invocation)
90
+ unless invocation.implanted? || invocation.nil?
91
+ pp [:implanting, invocation, invocation.class] if $DEBUG
92
+ invocation.class.class_exec(invocation) do |invocation|
93
+ a_methods = %w{
94
+ getSelectedMessages
95
+ getSelectedIssues
96
+ }
97
+ a_methods.each do |meth|
98
+ alias_method "__"+meth.to_s, meth
99
+ end
100
+ include Buby::Implants::ContextMenuInvocation
101
+ a_methods.each do |meth|
102
+ java_class.ruby_names_for_java_method(meth).each do |ruby_meth|
103
+ define_method ruby_meth, Buby::Implants::ContextMenuInvocation.instance_method(meth)
104
+ end
105
+ end
106
+ include Buby::Implants::Proxy
107
+ end
108
+ end
109
+ invocation
110
+ end
111
+ end
112
+ end
113
+ end
@@ -0,0 +1,47 @@
1
+ class Buby
2
+ module Implants
3
+ # This interface is used to hold details about an HTTP cookie.
4
+ #
5
+ # @note This module is used to extend the ICookie interface implementation
6
+ # java class at runtime.
7
+ module Cookie
8
+ # This method is used to retrieve the expiration time for the cookie.
9
+ #
10
+ # @return [Time] The expiration time for the cookie, or +nil+ if none is
11
+ # set (i.e., for non-persistent session cookies).
12
+ #
13
+ def getExpiration
14
+ ret = __getExpiration
15
+ ret.nil? ? ret : Time.at(ret.time/1000.0)
16
+ end
17
+
18
+ # Install ourselves into the current +ICookie+ java class
19
+ # @param [ICookie] cookie instance
20
+ #
21
+ def self.implant(cookie)
22
+ unless cookie.implanted? || cookie.nil?
23
+ pp [:implanting, cookie, cookie.class] if $DEBUG
24
+ cookie.class.class_exec(cookie) do |cookie|
25
+ a_methods = %w{
26
+ getExpiration
27
+ }
28
+ a_methods.each do |meth|
29
+ pp ["__" + meth, self] if $DEBUG
30
+ alias_method "__"+meth.to_s, meth
31
+ end
32
+ include Buby::Implants::Cookie
33
+ a_methods.each do |meth|
34
+ pp [meth, self] if $DEBUG
35
+ java_class.ruby_names_for_java_method(meth).each do |ruby_meth|
36
+ pp [ruby_meth, meth, self] if $DEBUG
37
+ define_method ruby_meth, Buby::Implants::Cookie.instance_method(meth)
38
+ end
39
+ end
40
+ include Buby::Implants::Proxy
41
+ end
42
+ end
43
+ cookie
44
+ end
45
+ end
46
+ end
47
+ end
@@ -0,0 +1,286 @@
1
+ class Buby
2
+ module Implants
3
+ # This interface contains a number of helper methods, which extensions can
4
+ # use to assist with various common tasks that arise for Burp extensions.
5
+ #
6
+ # Extensions can call +IBurpExtenderCallbacks.getHelpers()+ to obtain an
7
+ # instance of this interface.
8
+ # This module is used to extend the JRuby proxy class returned by Burp.
9
+ #
10
+ module ExtensionHelpers
11
+ # This method can be used to analyze an HTTP request, and obtain various
12
+ # key details about it. The resulting +IRequestInfo+ object
13
+ # will not include the full request URL.
14
+ #
15
+ # @overload analyzeRequest(request)
16
+ # Analyze a +HttpRequestResponse+ object.
17
+ # @param [IHttpRequestResponse] request The request to be analyzed.
18
+ # @overload analyzeRequest(httpService, request)
19
+ # Analyze a request from a +HttpService+ object, and a +String+ or
20
+ # +byte[]+.
21
+ # @param [IHttpService] http_service HTTP service description
22
+ # @param [String, Array<byte>] request The request to be analyzed
23
+ # @overload analyzeRequest(request)
24
+ # Analyze a +String+ or +byte[]+ request. To obtain the full URL, use one
25
+ # of the other overloaded {#analyzeRequest} methods.
26
+ # @param [String, Array<byte>] request The request to be analyzed
27
+ # @return [IRequestInfo] object (wrapped with Ruby goodness)
28
+ # that can be queried to obtain details about the request.
29
+ #
30
+ def analyzeRequest(*args)
31
+ pp [:got_analyze_request, *args] if $DEBUG
32
+ args[-1] = args[-1].to_java_bytes if args[-1].respond_to? :to_java_bytes
33
+ Buby::Implants::RequestInfo.implant(__analyzeRequest(*args))
34
+ end
35
+
36
+ # This method can be used to analyze an HTTP response, and obtain various
37
+ # key details about it.
38
+ #
39
+ # @param [String, Array<byte>] response The response to be analyzed.
40
+ # @return [IResponseInfo] object (wrapped with Ruby goodness) that can be
41
+ # queried to obtain details about the response.
42
+ #
43
+ def analyzeResponse(response)
44
+ pp [:got_analyze_response, response] if $DEBUG
45
+ response = response.to_java_bytes if response.respond_to? :to_java_bytes
46
+ Buby::Implants::ResponseInfo.implant(__analyzeResponse(response))
47
+ end
48
+
49
+ # This method can be used to retrieve details of a specified parameter
50
+ # within an HTTP request. <b>Note:</b> Use {#analyzeRequest} to obtain
51
+ # details of all parameters within the request.
52
+ #
53
+ # @param [String, Array<byte>] request The request to be inspected for the
54
+ # specified parameter.
55
+ # @param [String] parameter_name The name of the parameter to retrieve.
56
+ # @return [IParameter] object that can be queried to obtain details
57
+ # about the parameter, or +nil+ if the parameter was not found.
58
+ #
59
+ def getRequestParameter(request, parameter_name)
60
+ pp [:got_get_request_parameter, parameter_name, request] if $DEBUG
61
+ request = request.to_java_bytes if request.respond_to? :to_java_bytes
62
+ Buby::Implants::Parameter.implant(__getRequestParameter(request, parameter_name))
63
+ end
64
+
65
+ # This method searches a piece of data for the first occurrence of a
66
+ # specified pattern. It works on byte-based data in a way that is similar
67
+ # to the way the native Java method +String.indexOf()+ works on
68
+ # String-based data.
69
+ # @note This method is only wrapped for testing purposes. There are better ways to do this in the JRuby runtime.
70
+ #
71
+ # @param [String, Array<byte>] data The data to be searched.
72
+ # @param [String, Array<byte>] pattern The pattern to be searched for.
73
+ # @param [Boolean] case_sensitive Flags whether or not the search is case-sensitive.
74
+ # @param [Fixnum] from The offset within +data+ where the search should begin.
75
+ # @param [Fixnum] to The offset within +data+ where the search should end.
76
+ # @return The offset of the first occurrence of the pattern within the specified bounds, or nil if no match is found.
77
+ #
78
+ def indexOf(data, pattern, case_sensitive, from, to)
79
+ pp [:got_index_of, case_sensitive, from, to, data, pattern] if $DEBUG
80
+ data = data.to_java_bytes if data.respond_to?(:to_java_bytes)
81
+ pattern = pattern.to_java_bytes if data.respond_to?(:to_java_bytes)
82
+ ret = __indexOf(data, pattern, case_sensitive, from, to)
83
+ ret == -1 ? nil : ret
84
+ end
85
+
86
+ # This method builds an HTTP message containing the specified headers and
87
+ # message body. If applicable, the Content-Length header will be added or
88
+ # updated, based on the length of the body.
89
+ #
90
+ # @param [Array<String>] headers A list of headers to include in the message.
91
+ # @param [String, Array<byte>] body The body of the message, or +nil+ if the message has an empty body.
92
+ # @return [String] The resulting full HTTP message.
93
+ #
94
+ def buildHttpMessage(headers, body)
95
+ pp [:got_build_http_message, headers, body] if $DEBUG
96
+ body = body.to_java_bytes if body.respond_to?(:to_java_bytes)
97
+ String.from_java_bytes(__buildHttpMessage(headers, body))
98
+ end
99
+
100
+ # This method creates a GET request to the specified URL. The headers used
101
+ # in the request are determined by the Request headers settings as
102
+ # configured in Burp Spider's options.
103
+ #
104
+ # @param [URL, #to_s] url The URL to which the request should be made.
105
+ # @return [String] A request to the specified URL.
106
+ #
107
+ def buildHttpRequest(url)
108
+ pp [:got_build_http_request, url] if $DEBUG
109
+ url = Java::JavaNet::URL.new url.to_s unless url.kind_of?(Java::JavaNet::URL)
110
+ String.from_java_bytes __buildHttpRequest(url)
111
+ end
112
+
113
+ # This method adds a new parameter to an HTTP request, and if appropriate
114
+ # updates the Content-Length header.
115
+ #
116
+ # @param [String, Array<byte>, IHttpRequestResponse] request The request
117
+ # to which the parameter should be added.
118
+ # @param [IParameter, Hash] parameter An +IParameter+ object containing
119
+ # details of the parameter to be added. Supported parameter types are:
120
+ # * +PARAM_URL+
121
+ # * +PARAM_BODY+
122
+ # * +PARAM_COOKIE+
123
+ # @return [String] A new HTTP request with the new parameter added.
124
+ #
125
+ # @todo Switch IHttpRequestResponse to new Buby::Implants functionality (2.0)
126
+ def addParameter(request, parameter)
127
+ pp [:got_addParameter, parameter, request] if $DEBUG
128
+ request = request.request if request.kind_of? Java::Burp::IHttpRequestResponse
129
+ request = request.to_java_bytes if request.respond_to? :to_java_bytes
130
+ parameter = Buby::Parameter::Base.new parameter if parameter.kind_of? Hash
131
+ String.from_java_bytes(__addParameter(request, parameter))
132
+ end
133
+
134
+ # This method removes a parameter from an HTTP request, and if appropriate
135
+ # updates the Content-Length header.
136
+ #
137
+ # @param [String, Array<byte>, IHttpRequestResponse] request The request
138
+ # from which the parameter should be removed.
139
+ # @param [IParameter, Hash] parameter Object containing details of the
140
+ # parameter to be removed. Supported parameter types are:
141
+ # * +PARAM_URL+
142
+ # * +PARAM_BODY+
143
+ # * +PARAM_COOKIE+
144
+ # @return [String] A new HTTP request with the parameter removed.
145
+ #
146
+ # @todo Switch IHttpRequestResponse to new Buby::Implants functionality (2.0)
147
+ def removeParameter(request, parameter);
148
+ pp [:got_addParameter, parameter, request] if $DEBUG
149
+ request = request.request if request.kind_of? Java::Burp::IHttpRequestResponse
150
+ request = request.to_java_bytes if request.respond_to? :to_java_bytes
151
+ parameter = Buby::Parameter::Base.new parameter if parameter.kind_of? Hash
152
+ String.from_java_bytes(__removeParameter(request, parameter))
153
+ end
154
+
155
+ # This method updates the value of a parameter within an HTTP request, and
156
+ # if appropriate updates the Content-Length header.
157
+ # @note: This method can only be used to update the value of an existing
158
+ # parameter of a specified type. If you need to change the type of an
159
+ # existing parameter, you should first call {#removeParameter} to remove
160
+ # the parameter with the old type, and then call {#addParameter} to add
161
+ # a parameter with the new type.
162
+ #
163
+ # @param [String, Array<byte>, IHttpRequestResponse] request The request
164
+ # containing the parameter to be updated.
165
+ # @param [IParameter, Hash] parameter Object containing details of the
166
+ # parameter to be updated. Supported parameter types are:
167
+ # * +PARAM_URL+
168
+ # * +PARAM_BODY+
169
+ # * +PARAM_COOKIE+
170
+ # @return [String] A new HTTP request with the parameter updated.
171
+ #
172
+ # @todo Switch IHttpRequestResponse to new Buby::Implants functionality (2.0)
173
+ def updateParameter(request, parameter)
174
+ pp [:got_updateParameter, parameter, request] if $DEBUG
175
+ request = request.request if request.kind_of? Java::Burp::IHttpRequestResponse
176
+ request = request.to_java_bytes if request.respond_to? :to_java_bytes
177
+ parameter = Buby::Parameter::Base.new parameter if parameter.kind_of? Hash
178
+ String.from_java_bytes(__updateParameter(request, parameter))
179
+ end
180
+
181
+ # This method can be used to toggle a request's method between GET and
182
+ # POST. Parameters are relocated between the URL query string and message
183
+ # body as required, and the Content-Length header is created or removed as
184
+ # applicable.
185
+ #
186
+ # @param [String, Array<byte>, IHttpRequestResponse] request The HTTP
187
+ # request whose method should be toggled.
188
+ # @return [String} A new HTTP request using the toggled method.
189
+ #
190
+ # @todo Switch IHttpRequestResponse to new Buby::Implants functionality (2.0)
191
+ def toggleRequestMethod(request)
192
+ pp [:got_toggleRequestMethod, request] if $DEBUG
193
+ request = request.request if request.kind_of? Java::Burp::IHttpRequestResponse
194
+ request = request.to_java_bytes if request.respond_to? :to_java_bytes
195
+ String.from_java_bytes(__toggleRequestMethod(request))
196
+ end
197
+
198
+ # This method constructs an +IHttpService+ object based on the
199
+ # details provided.
200
+ #
201
+ # @overload buildHttpService(host, port, protocol)
202
+ # @param [String] host The HTTP service host.
203
+ # @param [Fixnum] port The HTTP service port.
204
+ # @param [String] protocol The HTTP service protocol.
205
+ # @overload buildHttpService(host, port, use_https)
206
+ # @param [String] host The HTTP service host.
207
+ # @param [Fixnum] port The HTTP service port.
208
+ # @param [Boolean] use_https Flags whether the HTTP service protocol is HTTPS or HTTP.
209
+ # @return [IHttpService] object based on the details provided.
210
+ #
211
+ def buildHttpService(host, port, protocol)
212
+ pp [:got_buildHttpService, host, port, protocol] if $DEBUG
213
+ Buby::Implants::HttpService.implant(__buildHttpService(host, port, protocol))
214
+ end
215
+
216
+ # This method constructs an +IParameter+ object based on the details
217
+ # provided.
218
+ #
219
+ # @param [String] name The parameter name.
220
+ # @param [String] value The parameter value.
221
+ # @param [Fixnum] type The parameter type, as defined in the
222
+ # +IParameter+ interface.
223
+ # @return [IParameter] object based on the details provided.
224
+ def buildParameter(name, value, type)
225
+ pp [:got_buildParameter, name, value, type] if $DEBUG
226
+ Buby::Implants::Parameter.implant(__buildParameter(name, value, type))
227
+ end
228
+
229
+ # This method constructs an +IScannerInsertionPoint+ object based on the
230
+ # details provided. It can be used to quickly create a simple insertion
231
+ # point based on a fixed payload location within a base request.
232
+ #
233
+ # @param [String] insertion_point_name The name of the insertion point.
234
+ # @param [String, Array<byte>, IHttpRequestResponse] base_request The request from which to
235
+ # build scan requests.
236
+ # @param [Fixnum] from The offset of the start of the payload location.
237
+ # @param [Fixnum] to The offset of the end of the payload location.
238
+ # @return [IScannerInsertionPoint] object based on the details provided.
239
+ #
240
+ # @todo Switch IHttpRequestResponse to new Buby::Implants functionality (2.0)
241
+ def makeScannerInsertionPoint(insertion_point_name, base_request, from, to)
242
+ pp [:got_makeScannerInsertionPoint, insertion_point_name, base_request, from, to] if $DEBUG
243
+ base_request = base_request.request if base_request.kind_of? Java::Burp::IHttpRequestResponse
244
+ base_request = base_request.to_java_bytes if base_request.respond_to? :to_java_bytes
245
+ Buby::Implants::ScannerInsertionPoint.implant(__makeScannerInsertionPoint(insertion_point_name, base_request, from, to))
246
+ end
247
+
248
+ # Install ourselves into the current +IExtensionHelpers+ java class
249
+ # @param [IExtensionHelpers] helpers
250
+ #
251
+ def self.implant(helpers)
252
+ unless helpers.implanted? || helpers.nil?
253
+ pp [:implanting, helpers, helpers.class] if $DEBUG
254
+ helpers.class.class_exec(helpers) do |helpers|
255
+ a_methods = %w{
256
+ analyzeRequest
257
+ analyzeResponse
258
+ getRequestParameter
259
+ indexOf
260
+ buildHttpMessage
261
+ buildHttpRequest
262
+ addParameter
263
+ removeParameter
264
+ updateParameter
265
+ toggleRequestMethod
266
+ buildHttpService
267
+ buildParameter
268
+ makeScannerInsertionPoint
269
+ }
270
+ a_methods.each do |meth|
271
+ alias_method "__"+meth.to_s, meth
272
+ end
273
+ include Buby::Implants::ExtensionHelpers
274
+ a_methods.each do |meth|
275
+ java_class.ruby_names_for_java_method(meth).each do |ruby_meth|
276
+ define_method ruby_meth, Buby::Implants::ExtensionHelpers.instance_method(meth)
277
+ end
278
+ end
279
+ include Buby::Implants::Proxy
280
+ end
281
+ end
282
+ helpers
283
+ end
284
+ end
285
+ end
286
+ end