初探Burp Suite API 开发

void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks)

Parameters:
callbacks - An IBurpExtenderCallbacks object.

def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

void processHttpMessage(int toolFlag,
                      boolean messageIsRequest,
                      IHttpRequestResponse messageInfo)

Parameters:
toolFlag - A flag indicating the Burp tool that issued the request. Burp tool flags are defined in the IBurpExtenderCallbacks interface.
messageIsRequest - Flags whether the method is being invoked for a request or response.
messageInfo - Details of the request / response to be processed. Extensions can call the setter methods on this object to update the current message and so modify Burp's behavior.

def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedResponse.getBodyOffset():].tostring()

......

IHttpService getHttpService()
This method is used to retrieve the HTTP service for this request / response.
Returns:
An IHttpService object containing details of the HTTP service.

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

java.lang.String getHost()
This method returns the hostname or IP address for the service.
Returns:
The hostname or IP address for the service.

int getPort()
This method returns the port number for the service.
Returns:
The port number for the service.

java.lang.String getProtocol()
This method returns the protocol for the service.
Returns:
The protocol for the service. Expected values are "http" or "https".

#获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the response.
Returns:
The HTTP headers contained in the response.

int getBodyOffset()
This method is used to obtain the offset within the response where the message body begins.
Returns:
The offset within the response where the message body begins.


short getStatusCode()
This method is used to obtain the HTTP status code contained in the response.
Returns:
The HTTP status code contained in the response.


java.util.List<ICookie> getCookies()
This method is used to obtain details of the HTTP cookies set in the response.
Returns:
A list of ICookie objects representing the cookies set in the response, if any.


java.lang.String getStatedMimeType()
This method is used to obtain the MIME type of the response, as stated in the HTTP headers.
Returns:
A textual label for the stated MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.


java.lang.String getInferredMimeType()
This method is used to obtain the MIME type of the response, as inferred from the contents of the HTTP message body.
Returns:
A textual label for the inferred MIME type, or an empty String if this is not known or recognized. The possible labels are the same as those used in the main Burp UI.

#获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()

java.lang.String getMethod()
This method is used to obtain the HTTP method used in the request.
Returns:
The HTTP method used in the request.

java.net.URL getUrl()
This method is used to obtain the URL in the request.
Returns:
The URL in the request.

java.util.List<java.lang.String> getHeaders()
This method is used to obtain the HTTP headers contained in the request.
Returns:
The HTTP headers contained in the request.

java.util.List<IParameter> getParameters()
This method is used to obtain the parameters contained in the request.
Returns:
The parameters contained in the request.

int getBodyOffset()
This method is used to obtain the offset within the request where the message body begins.
Returns:
The offset within the request where the message body begins.

byte getContentType()
This method is used to obtain the content type of the message body.
Returns:
An indication of the content type of the message body. Available types are defined within this interface.

#获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeRequest(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()

#-*-Thinking-*-
#coding=utf8
from burp import IBurpExtender
from burp import IHttpListener
from burp import IHttpRequestResponse
from burp import IResponseInfo
from burp import IRequestInfo
from burp import IHttpService

import re
# Class BurpExtender (Required) contaning all functions used to interact with Burp Suite API

print 'Thinking\'s find JSON callback Bui~'

class BurpExtender(IBurpExtender, IHttpListener):

    # define registerExtenderCallbacks: From IBurpExtender Interface 
    def registerExtenderCallbacks(self, callbacks):

        # keep a reference to our callbacks object (Burp Extensibility Feature)
        self._callbacks = callbacks
        # obtain an extension helpers object (Burp Extensibility Feature)
        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
        self._helpers = callbacks.getHelpers()
        # set our extension name that will display in Extender Tab
        self._callbacks.setExtensionName("find JSON callback")
        # register ourselves as an HTTP listener
        callbacks.registerHttpListener(self)

    # define processHttpMessage: From IHttpListener Interface 
    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):

        # determine what tool we would like to pass though our extension:
        if toolFlag == 64 or toolFlag == 16 or toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
            # determine if request or response:
            if not messageIsRequest:#only handle responses

                #获取响应包的数据
                response = messageInfo.getResponse()
                analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
                response_headers = analyzedResponse.getHeaders()
                response_bodys = response[analyzedResponse.getBodyOffset():].tostring()
                response_StatusCode = analyzedResponse.getStatusCode()

                #获取请求包的数据
                resquest = messageInfo.getRequest()
                analyzedRequest = self._helpers.analyzeResponse(resquest)
                request_header = analyzedRequest.getHeaders()
                request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()


                #获取服务信息
                httpService = messageInfo.getHttpService()
                port = httpService.getPort()
                host = httpService.getHost()

                #第一种情况：url中带有callback,且返回的是json数据。
                expressionA = r'.*(callback).*'
                expressionB = r'.*(application/json|application/javascript).*'
                expressionC = r'.*(text/html|application/javascript).*'
                for rqheader in request_header:
                    if rqheader.startswith("Host"):
                        rqhost = rqheader
                        break
                ishtml = 0        
                for rpheader in response_headers:
                    if rpheader.startswith("Content-Type:")  and re.match(expressionC,rpheader):
                        ishtml = 1

                    if rpheader.startswith("Content-Type:")  and  re.match(expressionB,rpheader):                            
                        if re.match(expressionA,request_header[0]):
                            print '='*10,'[success|有callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',request_header[0],'\n\n[ResponseBody]',response_bodys[0:30],'\n\n\n'
                            break

                #第二种情况：url中没有带callback,但是通过添加callback参数后，便返回了带方法名的json数据。
                if not re.match(expressionA,request_header[0]):
                    new_headers = request_header
                    if '?' in new_headers[0]:
                        new_headers[0] = new_headers[0].replace('?','?callback=BuiBui&')
                    else:
                        new_headers[0] = new_headers[0][:-9] +'?callback=BuiBui'

                    req = self._helpers.buildHttpMessage(new_headers, request_bodys) 
                    ishttps = False
                    if port == 443:
                        ishttps = True

                    if response_StatusCode == 200 and ishtml == 1:  
                        rep = self._callbacks.makeHttpRequest(host, port, ishttps, req)
                        #TODO 在某些情况下makeHttpRequest时候会出现一些bug,得到的结果但是取不到response,很奇怪(已经解决,404页面取不到正文返回包)

                        #新的请求请求包
                        analyzedreq = self._helpers.analyzeResponse(rep)
                        req_headers = analyzedreq.getHeaders()
                        req_bodys = rep[analyzedreq.getBodyOffset():].tostring()


                        #新的请求响应包
                        analyzedrep = self._helpers.analyzeResponse(rep)
                        rep_headers = analyzedrep.getHeaders()
                        rep_bodys = rep[analyzedrep.getBodyOffset():].tostring()


                        if 'BuiBui' in rep_bodys:
                            for repheader in rep_headers:
                                if repheader.startswith("Content-Type:")  and  re.match(expressionB,repheader):
                                    print '='*10,'[success|发现隐藏callback且返回json数据]','='*10,'\n\n[Host]',rqhost,port,'\n\n[URI]',req_headers[0],'\n\n[ResponseBody]',rep_bodys[0:30],'\n\n\n'
                                    break