Burp Extensions

Make a new post

  • Python Extension don't load in Burp on Fedora

    I've create test python extension: <pre> from burp import IBurpExtender class BurpExtender(IBurpExtender): def registerExtenderCallbacks(self, callbacks): # your extension code here return </pre> <pre> java.lang.NoClassDefFoundError: com/google/common/collect/MapMaker </pre> I've installed jython using Fedora installer and pu...

    2 Agent Answers    2 Community Answers
    Dec 21, 2017 08:33AM UTC
  • Regarding Burp Extensions

    Hi Team Currently I am using burp for sliverlight application which is developed in .NetFrame. .I am able to see the requests call in encrypted format which were developed in SOAP. Also I am unable to repeat the calls using repeater as it says session out etc... Can you please suggest if there are any plugins available for Sliverlight application tests Regards Prasad

    1 Agent Answer    0 Community Answer
    Dec 18, 2017 07:00AM UTC
  • Nested message editors

    Are there any artificial limitations regarding message editor nesting? By registering a message editor factory that creates instances of the class with the source code below, I expect it to act as as "proxy" and the resulting UI should be the same as with the original editor. This works fine if I just create it as a child of an ITab for example. However if I do this like below, invoking ...

    2 Agent Answers    1 Community Answer
    Dec 07, 2017 12:30PM UTC
  • IExtensionHelpers.urlDecode() not handling UTF-8

    I have an input string which contains an ENDASH encoded using UTF-8 as: %E2%80%93 When I decode that in my extension with IExtensionHelpers.urlDecode(String input) I get: – However, the Java URLDecoder.decode(String input, "UTF-8") produces the proper ENDASH: – What encoding is assumed internally by IExtensionHelpers.urlDecode()? Could the API be modified to allow ...

    4 Agent Answers    3 Community Answers
    Nov 30, 2017 12:34AM UTC
  • Burp Store and burp app validation

    Hi, Regarding the burp store, do you do any check regarding the content of the burp extension? How can we guarantee that there are 100% safe and no traffic will be sent to 3rd party? Appreciate your response. Thank you.

    1 Agent Answer    1 Community Answer
    Nov 28, 2017 09:41AM UTC
  • Collaborator: What are the exploitability differences between DNS lookups from different headers?

    Looking at the scan logs from Collaborator, I'm seeing medium severity for DNS lookups when the URL is supplied in either X-Forwarded-For or X-Wap-Profile, but red when it's caused by the Host header. I'm trying to understand why they are of different severity. In both instances, the server is performing a DNS request. Is it because the Host header isn't meant to be changed, so...

    1 Agent Answer    0 Community Answer
    Nov 25, 2017 12:11AM UTC
  • Need an extension to do advanced substitution

    We are using a commercial web app testing product to test a customer's massive application and we need to work around a problem in the webapp testing product. Turning the test, the product does a GET and the customer's server returns a page with these fragments: ----------------- <form name='win1' method='post' action="https://webaddress/url1"> &...

    1 Agent Answer    0 Community Answer
    Nov 15, 2017 06:12PM UTC
  • IBurpExtenderCallbacks.makeHttpRequest() throws RuntimeException

    If the network connection fails, callbacks.makeHttpRequest throws a RuntimeException. Any way we could get that method to declare that it throws a proper subclass of (presumably) IOException so we could check for and handle it in code?

    2 Agent Answers    1 Community Answer
    Nov 08, 2017 12:02AM UTC
  • How to retrieve only body of response

    Hello team I am making http requests to a site and how to get only body of the response. here is the code :- req = self._helpers.buildHttpMessage(headers, body) print self._helpers.bytesToString(req) resp = self.callbacks.makeHttpRequest("127.0.0.1", 1330, True, req) print self._helpers.bytesToString(resp) I have tried to get body by resp.getResponse() but it didnt wor...

    1 Agent Answer    0 Community Answer
    Oct 24, 2017 11:35AM UTC
  • Updating a parameter inline

    Hey, When updating a query parameter through the "IExtensionHelpers.updateParameter" method, the parameter is removed from the query parameters, then updated and appended to the end. Is this intended functionality and if so is there an easy way to update the parameter inline? Thanks, Justin

    1 Agent Answer    0 Community Answer
    Oct 20, 2017 06:31PM UTC