righettod / burp-piper-custom-scripts Goto Github PK

View Code? Open in Web Editor NEW

97.0 9.0 17.0 1.34 MB

Custom scripts for the PIPER Burp extensions.

License: GNU General Public License v3.0

Python 95.79% Shell 4.21%

burpsuite piper pentesting web

burp-piper-custom-scripts's Introduction

🚨 Project was stopped to move to Burp BCheck build-in feature.

Objective

Centralize and share all my custom scripts to be used with the PIPER Burp extension.

Documentation of the extension.

Runtime requirements

ℹ️ Reduced to the minimal ones needed, see file requirements.txt for details.

Python >= 3.9 needed and in PATH.

PS> python --version
Python 3.9.7

Compatibility tests

This GitHub action workfow validate that all scripts are compatible with Python 3.9, 3.10 on Windows, Mac and Linux OS.

Embedding of this collection of scripts into the PIPER source repository

This topic is pending on the PIPER's author side. Once ready, this repository will be merged.

IDE

Visual Studio Code with Python extension provided by Microsoft is used to develop the scripts.

Project workspace file has been configured to trigger the installation of required code analysis modules and analysis profile is defined in the workspace settings area.

Debug configuration was provided to debug a python script.

Structure

Each script describes its goal in its header, for which PIPER tools is targeted to be used and instruction regarding if HTTP headers must be passed as well as filter to define:

"""
PIPER script to ...
Target tool: [PIPER_TOOL]
[INSTRUCTION_IF_HTTP_HEADERS_MUST_BE_PASSED]
[FILTER_NEEDED_TO_BE_DEFINED]
"""

Overview of the scripts behavior

detect-non-standart-headers

Add a comment to the matching line in the proxy tab for every response containing non-standart HTTP headers.

detect-request-to-web-api

Highlight the matching line in the proxy tab for every request that is made to a web api.

extract-web-api-endpoints

Extract all API endpoints (and URL like because it is hard to really identify if a URL is an API endpoint or not from a static point view) from a JS script content obtained from a HTTP response.

extract-html-metadatas

Extract interesting information from HTML META tags from a HTTP response. Mainly used to quickly identify which products/tools was used to build the site/application.

detect-response-with-errors-disclosure

Detect HTTP responses containing a strack trace. Mainly used to quickly identify pages disclosing technical information via stack traces.

extract-jwt-tokens

🎯 This script was created in order to avoid the need to use another extensions or the decoder to just see the content of the token.

Extract and pretty-display all JWT tokens present in an HTTP response.

extract-blazor-webassembly-assemblies

🎯 Just copy/paste the script section in a ps1 / sh file and execute it to retrieve all the assemblies.

Extract the collection of assemblies from a HTTP response describing the assemblies used by a Blazor WebAssembly application.

A script to download all the assemblies, is generated in the same time:

For Windows is PowerShell.
For other is Bash.

extract-uuid-infos

👏 Inspired from this project so, credits goes first to it!

Extract the collection of UUID present in a HTTP response and then, depending on the version of UUID, extract the infos for each of them.

Sources:

extract-spa-unsafe-patterns

Extract all occurences of unsafe patterns used in a Single Page Application (SPA) main JS bundle file.

The objective is to quickly spot if framework built-in security features are disabled or if unsafe code patterns are used in order to identify potential attack vectors on the client side.

extract-spa-low-hanging-fruits

Extract elements from a Single Page Application (SPA) html files and main JS bundles that can be interesting from security point of view.

The objective is to quickly spot interesting low-level issues than can used as foundation to discover more critical issues.

extract-saml-response-infos

🎯 This script was created in order to avoid the need to use another extensions or the decoder to just see the content of the SAML response.

Extract and pretty-display information from a SAML response present in an HTTP response.

extract-saml-request-infos

🎯 This script was created in order to avoid the need to use another extensions or the decoder to just see the content of the SAML request.

Extract and pretty-display information from a SAML request present in an HTTP request.

Configuration

⚠️ Change the script location path defined in prefix field for all custom scripts before to import the configuration.

After the import, do not forget to enable the scripts because they are all disabled by default by the import command.

For Highlighters, the color can be changed before the import by changing the color field to one constants supported by PIPER/BURP.

The file piper-config.yaml contains the complete configuration that I use for all my custom scripts.

burp-piper-custom-scripts's People

Contributors

Stargazers

Watchers

Forkers

attacker-codeninja bsysop landaboot bbhunter internal0x03 inosec2 theblackturtle magnologan fawadkhanfk isjuye polling-repo-continua dukelaar yar-sen affilares unashamedgeek evcuq4hggjd74lhz

burp-piper-custom-scripts's Issues

Feature: Extract Blazor assemblies location for download

Create a script of Message viewer type that extract the collection of assemblies used by a Blazor app and indicated in this exchange.

Request

GET /_framework/blazor.boot.json HTTP/2
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Pragma: no-cache
Cache-Control: no-cache
Te: trailers
Connection: close

Response

HTTP/2 200 OK
Cache-Control: no-cache
Date: Fri, 15 Jan 2021 18:05:21 GMT
Content-Type: application/json
Last-Modified: Fri, 30 Oct 2020 17:49:39 GMT
Accept-Ranges: bytes
Etag: "1d6aee509d973e3"
Server: Kestrel
Vary: Content-Encoding
Content-Length: 4387
Blazor-Environment: Production

{
  "cacheBootResources": true,
  "config": [
    "appsettings.json"
  ],
  "debugBuild": false,
  "entryAssembly": "BlazorWithIdentity.Client",
  "linkerEnabled": true,
  "resources": {
    "assembly": {
      "BlazorWithIdentity.Client.dll": "sha256-Z2lEbzKo0SAOltnnXTs4S\/agx6tyTImPnBFWGXHc52Y=",
      "BlazorWithIdentity.Shared.dll": "sha256-ik9aZdyB6CorzAkiecKOyj0O4VDaJkR7otYB2iY2kfk=",
      "Google.Protobuf.dll": "sha256-GuzwaNy8IfOdRVA5O07oem30gUDQ7eQjbmftykOJsxY=",
      "Grpc.Core.Api.dll": "sha256-2ZHJEZ3vySpPHBExkcdKxDCnnb1a8quT3vWYH+Dd7Pk=",
      "Grpc.Net.Client.dll": "sha256-qVftmkL2+Qgwwf2PXanBUD0G8thridbHZn9raN5DBys=",
      "Grpc.Net.Client.Web.dll": "sha256-Csu\/IzjDjtaByhDPI8OF5GcYNe+ZEd9QD46PjRefgK8=",
      "Grpc.Net.Common.dll": "sha256-H1wirdO4+Hro1KENObyLLxx03cJvOt0cVbAGTlntOcE=",
      "Microsoft.AspNetCore.Authorization.dll": "sha256-\/q6kGb7yZvRMGcL6zOYKPNEH46cYWIpsjLKM++DBN9U=",
      "Microsoft.AspNetCore.Components.Authorization.dll": "sha256-Orxwc2Y0dTsD+Fv6TygBBfy8zI+ymUQtpXhwmfJERFY=",
      "Microsoft.AspNetCore.Components.dll": "sha256-IyigWcZ+vKebognbdmHnmcZFuiI0q9e+QBrijeuPnFk=",
      "Microsoft.AspNetCore.Components.Forms.dll": "sha256-duy1J6Uv\/JsUavXaF77\/DttL6GpZqJSLi6+mizT\/uwA=",
      "Microsoft.AspNetCore.Components.Web.dll": "sha256-1hAKZ5UTNPEFmOx6Sh7x9lm\/rydq\/rcVo2YEsirfQF0=",
      "Microsoft.AspNetCore.Components.WebAssembly.dll": "sha256-q3Sv8UM1wgfUD201JnpRjqDFIBdTv48TqCDNPy0LH4o=",
      "Microsoft.AspNetCore.Metadata.dll": "sha256-zMw2dpCz0o+GQqEh4gBt283OSDlvY6lJfm4H3FdVOGw=",
      "Microsoft.Bcl.AsyncInterfaces.dll": "sha256-jzHgXWAvWMkKIGFjZoT84tbe72E+H7CvTr\/Dryh4QPs=",
      "Microsoft.Extensions.Configuration.Abstractions.dll": "sha256-nRubUtYjR4O+x6\/MGb4+9tzXpnQh+9G4632Ea67+IE8=",
      "Microsoft.Extensions.Configuration.dll": "sha256-Sar1BOWHF67DgSc9Foxkd+WJRYjqUuTVlITul0GVjcc=",
      "Microsoft.Extensions.Configuration.Json.dll": "sha256-7cLAlpMwFwgMutK3aBKX+RCmuIUbNvss6daiTT1oKkU=",
      "Microsoft.Extensions.DependencyInjection.Abstractions.dll": "sha256-zBz3KdmM6evpHWky5s6odn+YeZJavcJBPmOymoriAIQ=",
      "Microsoft.Extensions.DependencyInjection.dll": "sha256-UX5p8q9WmAQxFYsvheI3DICNM2yGWtC+61IrPVmDtKA=",
      "Microsoft.Extensions.Logging.Abstractions.dll": "sha256-um4xnxdUUZ2OC20WMo\/igpqg5Sbam\/\/t4kc+jiDSbzQ=",
      "Microsoft.Extensions.Logging.dll": "sha256-Efrs1+dKciQ6cz7lomes7+pGwsf3fGevKmjnfAZh6O8=",
      "Microsoft.Extensions.Options.dll": "sha256-BtaMPfrpyjEao\/lC2+nwow4NleFWHCg\/\/NYeK9z+0yE=",
      "Microsoft.Extensions.Primitives.dll": "sha256-HjrG833QHmJjvnOZ1\/gsibHRRM\/nzf0s7EGAiLMmTIU=",
      "Microsoft.JSInterop.dll": "sha256-GFqkJmxwbf7WMrZ+MCRzaOADzSsVQ9tcMrMt19fsEeo=",
      "Microsoft.JSInterop.WebAssembly.dll": "sha256-UZa5CS19ZrbM6Csnl8CUIQucvmKMc4TughggTxKhx\/I=",
      "Mono.Security.dll": "sha256-ikIV2o0O8C+KqZyIBgrg1AhWi6slnrAE11LRFGHHq3Q=",
      "mscorlib.dll": "sha256-fI3t6vUsYjGIQOIspfrzn1AAMn+KQ4AnM2uxEkRoxrY=",
      "System.ComponentModel.DataAnnotations.dll": "sha256-Z3CvBRw5wh27jYj3AuqnWErilGNmA2P8E26ry65eAas=",
      "System.Core.dll": "sha256-kKCI9UpaUNUusslgagUy6AU7bkdHn\/fh8EVZxLmRgeU=",
      "System.Diagnostics.DiagnosticSource.dll": "sha256-4R+HkDmALWb1BMPgQYPwUq5jL92TzV3Qsd8HwQ43j9o=",
      "System.dll": "sha256-5wjcQbAyP0chC1kgYSr5I999\/kmdEXa8aw9BoyHy+ok=",
      "System.Net.Http.dll": "sha256-uT35V9CevHzBz6TtKFgqH3OQKy3kdR5OXVKl3ToYwyY=",
      "System.Net.Http.Json.dll": "sha256-2sqV\/11U+nVgFKlib2XOqHr43n7QA4cYHTUhoyrrkzA=",
      "System.Net.Http.WebAssemblyHttpHandler.dll": "sha256-hd1dCRyJHXCJCapAMVres+w7aW3FFSfRfHPYwLlcxK0=",
      "System.Runtime.CompilerServices.Unsafe.dll": "sha256-Em+49zPqogpeAhaz66kFrF+NyUYsQ+UQ4WXu9dv15PM=",
      "System.Text.Encodings.Web.dll": "sha256-u2\/+yhJcv4Qg7BOJIoJoA9OQPSZRFqzMbS4ZjiSDaaI=",
      "System.Text.Json.dll": "sha256-bF1LPxex6H2KlLu1imyzLFe\/Xo7+WrKjEwN4q0DQtpY=",
      "WebAssembly.Bindings.dll": "sha256-Bo2zdt9O1E82yMK8QiT\/2r0zNnOJsBxVB9SJC4OlrSI="
    },
    "pdb": null,
    "runtime": {
      "dotnet.3.2.0.js": "sha256-mPoqx7XczFHBWk3gRNn0hc9ekG1OvkKY4XiKRY5Mj5U=",
      "dotnet.timezones.dat": "sha256-3S0qzYaBEKOBXarzVLNzNAFXlwJr6nI3lFlYUpQTPH8=",
      "dotnet.wasm": "sha256-UC\/3Rm1NkdNdlIrzYARo+dO\/HDlS5mhPxo0IQv7kma8="
    },
    "satelliteResources": null
  }
}

Assemblies files are hosted in folder [HOST]/[CTX_ROOT]/_framework/_bin/[FILE].dll

The script should generate the code using curl (present on Windows via PowerShell and by default on Linux) to download all the assemblies by only changing a variable to specify the base url because it not available in the HTTP response.

The script must only be usable if the HTTP response header Blazor-Environment: [\w\d]+ is present.

Curl command template:

$ curl https://$host/_framework/_bin/BlazorWithIdentity.Client.dll --output  BlazorWithIdentity.Client.dll

New script to detect UUID v1 in a HTTP response

Based on the following articles:

Create a Message viewers script that will identify every UUID v1 in a HTTP response body and extract the info about every UUID found.

Feature: Detection of MAP files for SPA main JS bundle

Describe the feature wanted

Add detection of the map file in the script extract-spa-low-hanging-fruits.py:

//...
//# sourceMappingURL=main.dqfcf86f.chunk.js.map

Feature: Add support for Vue.js framework

Describe the feature wanted

Add the dangerous patterns for the Vue.js framework in the script extract-spa-unsafe-patterns.py.

righettod / burp-piper-custom-scripts Goto Github PK

burp-piper-custom-scripts's Introduction

Objective

Runtime requirements

Compatibility tests

Embedding of this collection of scripts into the PIPER source repository

IDE

Structure

Overview of the scripts behavior

detect-non-standart-headers

detect-request-to-web-api

extract-web-api-endpoints

extract-html-metadatas

detect-response-with-errors-disclosure

extract-jwt-tokens

extract-blazor-webassembly-assemblies

extract-uuid-infos

extract-spa-unsafe-patterns

extract-spa-low-hanging-fruits

extract-saml-response-infos

extract-saml-request-infos

Configuration

burp-piper-custom-scripts's People

Contributors

Stargazers

Watchers

Forkers

burp-piper-custom-scripts's Issues

Describe the feature wanted

Describe the feature wanted

Recommend Projects

Recommend Topics

Recommend Org