-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* progress, stop, multithreaded, precompiled regex * feat: updated to JDK17 * docs: updated README * fix: formatted files * fix: disable analysis button while stopping * fix: use memory instead of files * refactor: general changes to uniform style * refactor: BurpLeaksScanner * feat: added message on extension load * fix: interrupt scan instantly * WIP: refactor: MainUI * refactor: MainUI - Logger pane * refactor: MainUI - Options pane * fix: reset didn't compile the regex * -- some code cleanup -- fix thread number -- bump gson dep -- removed unused method Co-authored-by: Alessio Dalla Piazza <[email protected]>
- Loading branch information
1 parent
20e3739
commit d015348
Showing
22 changed files
with
1,005 additions
and
1,597 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,64 +1,68 @@ | ||
| # CYS4-SensitiveDiscoverer | ||
|
|
||
| > Burp Suite extension to scan for sensitive strings in HTTP messages. | ||
| ## Introduction | ||
|
|
||
| Burp Suite is a useful tool used to do web application security testing. While Burp Suite provides a lot of | ||
| functionalities, it does not offer the opportunity to scan for particular pattern or file extension inside HTTP messages | ||
| and is very tedious to check every message manually. | ||
| CYS4-SensitiveDiscoverer is a Burp Suite tool used to extract Regular Expression or File Extension form HTTP response automatically or | ||
| at the end of all tests or during the test. The plugin will be available with a pre-defined set of Regular Expression | ||
| and File Extension, but then you can choose which of them activate or deactivate and also create your own lists. | ||
| functionalities, it does not offer the opportunity to scan for particular pattern or file extensions inside HTTP messages. Checking every message by hand can be a very tedious process. | ||
|
|
||
| `CYS4-SensitiveDiscoverer` is a Burp Suite extension that solves this problem. With this extension you can automatically search sensitive strings in HTTP messages. It uses a list of Regular Expressions and File Extensions to match for in each message. | ||
|
|
||
| The plugin is available with a pre-defined set of Regular Expression and File Extensions, but you can also add your custom lists. | ||
|
|
||
| ## How to compile from source code | ||
|
|
||
| The extension was compiled with IntelliJ 2021.2.2, with OpenJDK version 16.0.1. | ||
| The extension was compiled with OpenJDK 17. | ||
|
|
||
| The BApp can be compiled with Maven by following these steps: | ||
|
|
||
| 1. View > Tool Windows > Maven. | ||
| 2. On the new right panel expand the Lifecycle folder. | ||
| 3. Double-click on install. | ||
|
|
||
| The BApp could be compiled with a Maven by following the below steps: | ||
| The compiled extension will be in the "/target" folder. | ||
|
|
||
| 1. View > Tool Windows > Maven | ||
| 2. On the new right panel expand the Lifecycle folder | ||
| 3. Double-click on install | ||
| ### Using Maven from CLI | ||
|
|
||
| Using Maven configuration will be generated a .jar file that will include all the dependencies. | ||
| As an alternative, run the following command: | ||
|
|
||
| ```bash | ||
| mvn clean package | ||
| ``` | ||
|
|
||
| ## Installation | ||
|
|
||
| To install CYS4-SensitiveDiscoverer manually, you have to: | ||
|
|
||
| 1. Download newest CYS4-SensitiveDiscoverer from the Release page | ||
| 2. Go to Extender -> Extension. Click Add. Set Extension type to Java. Set the path of the file download at step 1. | ||
| inside Extension file (.jar) | ||
| 3. CYS4-SensitiveDiscoverer should appear inside Burp Extension list. Also you will see a new tab. | ||
| 1. Download newest CYS4-SensitiveDiscoverer from the Release page. | ||
| 2. Go to Extender -> Extension. Click Add. Set Extension type to Java. Set the path of the (.jar) to the file downloaded at step 1. | ||
| 3. CYS4-SensitiveDiscoverer should appear inside Burp Extension list. A new tab will also appear. | ||
|
|
||
| ## Usage | ||
|
|
||
| The default configuration has a list of regular expression and file extension. To see the predefined list go to Options | ||
| TAB. Here you can choose which of them activate or not or you can choose to insert your own regular expression or file | ||
| extension. For both of them there are a list of actions to interact with them The actions are: | ||
| The default configuration has a list of regular expression and file extension. | ||
|
|
||
| To see the predefined list go to the Options tab. There you can choose which of them to activate and you can also insert your own regular expressions. | ||
|
|
||
| These are the actions to manage the list: | ||
|
|
||
| - **Reset**: the plugin will reset the default list of regular expression or file extension. | ||
| - **New**: a pop-up will appear and offer the opportunity to insert a new regular expression or file extension. | ||
| - **Delete**: after selecting a row, this will be deleted from the list. | ||
| - **Clear**: the plugin will clear the list leave them empty. | ||
| - **Open**: a pop-up will appear and offer the opportunity to insert in bulk a list of regular expression or file | ||
| extension from a file. | ||
| - **Save**: the plugin offer the possibility to save your custom list for future tests. After you have select your own | ||
| desired configuration you can start to find sensitive informations inside HTTP messages. The plugin will be execute in | ||
| two different modes: | ||
| - **Open**: a pop-up will appear and offer the opportunity to insert in bulk a list of regular expression or file extension from a file. | ||
| - **Save**: the plugin offer the possibility to save your custom list for future tests. After you have select your own desired configuration you can start to find sensitive information inside HTTP messages. The plugin will be execute in two different modes: | ||
|
|
||
| 1. **Analyze HTTP History**: the plugin will parse all http history generated from that moment and it will find any | ||
| active pattern | ||
| 2. **Live**: the plugin will parse request by request as the user will generates one from his web browser. | ||
| 1. **Analyze HTTP History**: the plugin will parse all http history generated from that moment and it will find any active pattern. | ||
| 2. **Live**: the plugin will parse request by request as the user will generates one from his web browser. | ||
|
|
||
| ## Credits | ||
|
|
||
| CYS4 was born in 2015 from a collaboration with an Israeli company in the world of Cyber Security, then detaching its team ensuring the focus on innovation and quality towards a national context. | ||
|
|
||
| Check out our [blog](https://blog.cys4.com/) for more information. | ||
| Check out [our blog](https://blog.cys4.com/) for more information. | ||
|
|
||
| ## References | ||
|
|
||
| - [shhgit](https://github.com/eth0izzle/shhgit/blob/master/config.yaml): Regex and File Extension database used in this project. | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,55 +1,16 @@ | ||
| package burp; | ||
|
|
||
| import cys4.ui.MainUI; | ||
| import cys4.model.ExtensionEntity; | ||
| import cys4.model.RegexEntity; | ||
| import cys4.seed.BurpLeaksSeed; | ||
|
|
||
| import java.io.PrintWriter; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| public class BurpExtender implements IBurpExtender { | ||
| private IBurpExtenderCallbacks callbacks; | ||
| private IExtensionHelpers helpers; | ||
|
|
||
| //private List<LogEntity> _lLogEntries = new ArrayList<>(); | ||
| private List<RegexEntity> _lRegexes; | ||
| private List<ExtensionEntity> _lExtensions; | ||
| private MainUI mainUI; | ||
|
|
||
| // Implement default constructor | ||
| public BurpExtender() | ||
| { | ||
| _lRegexes = new ArrayList<>(); | ||
| _lExtensions = new ArrayList<>(); | ||
| } | ||
|
|
||
| // | ||
| // implement IBurpExtender | ||
| // | ||
| @Override | ||
| public void registerExtenderCallbacks(final IBurpExtenderCallbacks callbacks) { | ||
| MainUI mainUI = new MainUI(callbacks); | ||
| mainUI.initialize(); | ||
|
|
||
|
|
||
| // get regexes and extensions | ||
| BurpLeaksSeed bls = new BurpLeaksSeed(); | ||
|
|
||
| this._lRegexes = BurpLeaksSeed.getRegex(); | ||
| this._lExtensions = BurpLeaksSeed.getExtensions(); | ||
|
|
||
| // keep a reference to our callbacks object | ||
| this.callbacks = callbacks; | ||
|
|
||
| // obtain an extension helpers object | ||
| this.helpers = callbacks.getHelpers(); | ||
|
|
||
| // init the main UI methods | ||
| this.mainUI = new MainUI(_lRegexes, _lExtensions, callbacks); | ||
| this.mainUI.createUI(); | ||
|
|
||
| // set our extension name | ||
| callbacks.setExtensionName(mainUI.getNameExtension()); | ||
|
|
||
|
|
||
| callbacks.printOutput("Extension loaded successfully!"); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.