This document serves as a comprehensive guide for customizing Burp Suite through the use of extensions, covering installation, development, and management of these extensions. It includes practical examples and methods for building both passive and active scanners, as well as how to manipulate HTTP requests and enhance user interface components. Additionally, it references resources such as the BApp Store and provides links to GitHub projects for further exploration.

1. Customizing Burp Suite
Getting the Most out of
Burp Extensions

2. August Detlefsen
• Senior Application Security Consultant
• Author
augustd@codemagi.com
@codemagi
http://www.codemagi.com/blog

3. Monika Morrow
• Senior Application Security Consultant
@ AppSec Consulting
mmorrow@appsecconsulting.com
@fortytwowho

4. Agenda/Overview
• Extensions
• Using the BApp Store
• Building Your First Extension
• Adding GUI to extensions
• Building Scanners
• Utilities

5. Burp Suite
• What is Burp?
• What are extensions?
– What can I do with them? (use cases)

6. What Can I Do With Extensions?
• Passive Scanning
• Active Scanning
• Alter/append requests
• Define Insertion Points for Scanner/Intruder
• Create new payload types
• Automate Authentication
• Much, Much More

7. BApp Store
• What is it?
• How do I use it?
• A look at some useful extensions
– Logger++
– WSDL Wizard

8. BApp Store

9. Burp Extension Tab

10. BApp Store

11. Logger++

12. List of Active/Inactive Burp Extensions

13. Logger++ Options

14. Logger++ View Logs

15. Logger++ Item Details

16. Jython Extensions

17. Burp Extensions Settings

18. Burp Extensions Settings

19. One Click Install Jython Extensions

20. WSDL Wizard Installed

21. Installed Burp Extensions

22. WSDL Wizard Usage

23. WSDL Wizard Results

24. Limited Examples
• Proprietary code
• One-Offs
• No process for updating BApp Store
extensions

25. Loading a Custom Extension
• Java, Python, and Ruby extensions are loaded
and managed through a single interface within
the Extension tab

26. Loading a Custom Extension

27. Loading a Custom Extension

28. Loading a Custom Extension

29. Loading a Custom Extension

30. Loading a Custom Extension

31. Building Custom Extensions
• Burp Suite Pro v 1.6.x
• Current NetBeans IDE (8.0.2)
• JDK 8

32. Starting with a Template
• Find a starter project
• Some example projects at
https://portswigger.net/burp/extender/
• Today we’ll start with my NetbeansGUI project
found at https://github.com/monikamorrow/
Burp-Suite-Extension-Examples
– Which depends on https://github.com/augustd/burp-
suite-utils

33. Starting with a Template
• Clone Burp-Suite-Extension-Examples and
burp-suite-utils into your working directory
• Open the Burp-Suite-Extension-Examples
NetBeans project and expand folders and
resolve issues along the way
• Compile the project to resolve remaining
issues

34. Open the NetBeans Project

35. Problems already! No problem.

36. Resolve Project Problems

37. Find the Cloned Project

38. ….and Repeat. Resolved.

39. Now what!?

40. Invalid Java Version?

41. Select Java Version

42. Resolved!

43. More Problems?

44. Compile to Fix!
Building jar:
C:UsersmmorrowDocumentsGit
Hub
Burp-Suite-Extension-Examples
Example4NetBeansGUIBurpExtend
erdist
BurpExtender-combined.jar
jar:
BUILD SUCCESSFUL (total time:
1 second)

45. Edit build.xml
<target name="-post-jar">
<jar jarfile=
"dist/BurpExtender-combined.jar">
<zipfileset src="${dist.jar}" />
<zipgroupfileset dir="dist/lib"
includes="*.jar”
excludes="META-INF/*"/>
</jar>
</target>

46. Test!

47. Let's Write Some Code
• Start new class BurpExtender
• Import BurpGUIExtender
• Implement BurpGUIExtender's abstract
functions
– init()
– processSelectedMessage()

48. BurpExtender
package burp;
import com.monikamorrow.burp.BurpGUIExtender;
public class BurpExtender extends
BurpGUIExtender { ... }

49. BurpExtender
public class BurpExtender extends
BurpGUIExtender {
public void init() {
mPluginName = "MYPROJECT";
mUsageStatement =
"Usage statement for " + mPluginName;
}
}

50. BurpExtender
public class BurpExtender extends BurpGUIExtender
protected IHttpRequestResponse
processSelectedMessage(
IHttpRequestResponse messageInfo,
boolean isRequest) {
...
return messageInfo;
}
}

51. BurpExtender
{
if(isRequest) {
mStdOut.println(
"processSelectedMessage triggered for request");
messageInfo.setComment("Request processed");
} else {
mStdOut.println(
"processSelectedMessage triggered for response");
messageInfo.setComment(
messageInfo.getComment() + "/Response processed");
}
return messageInfo;
}

52. What's Available?
• Mix and match
– BurpGUIExtender
– BurpSuiteTab
• ToolsScopeComponent
• UrlScopeComponent
– BaseExtender
– PassiveScan
– ….and more

53. GUI Components
• Configuration of options
• Enable only what you want
• Autosave

54. How to Add?
mTab = new BurpSuiteTab
(mPluginName, mCallbacks);
mTab.add(toolsScope);
mTab.add(urlScope);
mTab.add(myJPanel);
mCallbacks.customizeUiComponent(mTab);
mCallbacks.addSuiteTab(mTab);

55. How to Get Settings?
urlScope.processAllRequests();
toolsScope.isToolSelected(toolFlag);

56. Passive Scanning
• Search responses for problematic values
• Built-in passive scans
– Credit card numbers
– Known passwords
– Missing headers
Building a Passive Scanner

57. Passive Scanning – Room for Improvement
• Error Messages
• Software Version Numbers
Building a Passive Scanner

58. Implement the IScannerCheck interface
public class PassiveScan implements IScannerCheck {
@Override
public List<IScanIssue> doPassiveScan(
IHttpRequestResponse baseRequestResponse) { … }
@Override
public List<IScanIssue> doActiveScan(
IHttpRequestResponse baseRequestResponse,
IScannerInsertionPoint insertionPoint) { … }
@Override
public int consolidateDuplicateIssues(
IScanIssue existingIssue, IScanIssue newIssue) { … }
Building a Passive Scanner

59. Register the extension as a custom scanner
@Override
protected void initialize() {
callbacks.registerScannerCheck(this);
}
Building a Passive Scanner

60. IScannerCheck.doPassiveScan()
for (MatchRule rule : rules) {
Matcher matcher =
rule.getPattern().matcher(response);
while (matcher.find()) {
matches.add(
new ScannerMatch(
matcher.start(), matcher.end(), group, rule));
Building a Passive Scanner

61. IScannerCheck.doPassiveScan()
if (!matches.isEmpty()) {
Collections.sort(matches);
List<int[]> startStop =
new ArrayList<int[]>(1);
for (ScannerMatch match : matches) {
startStop.add(new int[]{
match.getStart(), match.getEnd()
});
Building a Passive Scanner

62. IScannerCheck.doPassiveScan()
return new ScanIssue(
baseRequestResponse.getHttpService(),
helpers.analyzeRequest(baseRequestResponse)
.getUrl(),
new IHttpRequestResponse[] {
callbacks.applyMarkers(
baseRequestResponse, null, startStop)},
issueName, issueDetail,
ScanIssueSeverity.MEDIUM,
ScanIssueConfidence.FIRM
Building a Passive Scanner

63. IScannerCheck.consolidateDuplicateIssues()
@Override
public int consolidateDuplicateIssues(
IScanIssue existingIssue, IScanIssue newIssue) {
if (existingIssue.getIssueDetail()
.equals(newIssue.getIssueDetail())) {
return -1; //It is a duplicate
} else {
return 0; //This is a new issue
}
Building a Passive Scanner

64. Extending from PassiveScan
@Override
protected void initPassiveScan() {
//set the extension Name
extensionName = "Error Message Checks";
//create match rules
addMatchRule(
new MatchRule(PHP_ON_LINE, 0, "PHP"));
addMatchRule(
new MatchRule(PHP_HTML_ON_LINE, 0, "PHP"));
…
Building a Passive Scanner

65. Extending from PassiveScan
@Override
protected ScanIssue getScanIssue(
IHttpRequestResponse baseRequestResponse,
List<ScannerMatch> matches, List<int[]> startStop) {
return new ScanIssue(
baseRequestResponse,
helpers,
callbacks,
startStop,
getIssueName(),
getIssueDetail(matches),
ScanIssueSeverity.MEDIUM.getName(),
ScanIssueConfidence.FIRM.getName());
Building a Passive Scanner

66. Active Scanning
• Issue requests containing attacks
• Look for indication of success in response
• Built-In Active Scans
– XSS
– SQL Injection
– Path Traversal
– etc
Building an Active Scanner

67. IScannerCheck.doActiveScan()
@Override
public List<IScanIssue> doActiveScan(
IHttpRequestResponse baseRequestResponse,
IScannerInsertionPoint insertionPoint) {
for (MatchRule rule : rules) {
// compile a request containing our
// injection test in the insertion point
byte[] testBytes = rule.getTest();
byte[] checkRequest =
insertionPoint.buildRequest(testBytes);
Building an Active Scanner

68. IScannerCheck.doActiveScan()
// issue the request
IHttpRequestResponse checkRequestResponse =
callbacks.makeHttpRequest(
httpService, checkRequest);
//get the response
String response = helpers.bytesToString(
checkRequestResponse.getResponse());
Building an Active Scanner

69. IScannerCheck.doActiveScan()
// get the offsets of the payload
// within the request, for in-UI highlighting
List<int[]> requestHighlights =
new ArrayList<int[]>(1);
requestHighlights.add(
insertionPoint.getPayloadOffsets(testBytes));
Building an Active Scanner

70. Extending from ActiveScan
@Override
protected void initActiveScan() {
//set the extension Name
extensionName = "Server Side Javascript Injection checks";
//create match rules
addMatchRule(
new MatchRule("response.end('success')", SUCCESS, 0, "response.end"));
addMatchRule(
new MatchRule("1995';return(true);var%20foo='bar", TRUE, 0, "string"));
Building an Active Scanner

71. Insertion Points
• Locations of parameters in request
• Contain data the server will act upon
Building an Active Scanner

72. Defining Insertion Points

73. Defining Insertion Points

74. Defining Insertion Points
• Implement IScannerInsertionPointProvider
– getInsertionPoints()
• Register as an insertion point provider:
callbacks.
registerScannerInsertionPointProvider(this);
Defining Insertion Points

75. BurpExtender.getInsertionPoints()
@Override
public List<IScannerInsertionPoint>
getInsertionPoints(
IHttpRequestResponse baseRR) {
byte[] request = baseRR.getRequest();
String requestAsString =
new String(request);
GWTParser parser = new GWTParser();
parser.parse(requestAsString);
Defining Insertion Points

76. BurpExtender.getInsertionPoints()
for (int[] offset : insertionPointOffsets) {
IScannerInsertionPoint point =
helpers.makeScannerInsertionPoint(
"GWT",
request,
offset[0] - bodyStart,
offset[1] - bodyStart);
insertionPoints.add(point);
}
return insertionPoints;
Defining Insertion Points

77. Defining Insertion Points

78. Viewing Insertion Points
• Add menu option to send request to Intruder
• Implement IContextMenuFactory
– createMenuItems()
• Register as a menu factory
callbacks.registerContextMenuFactory(this);
Defining Insertion Points

79. BurpExtender.createMenuItems()
@Override
public List<JMenuItem> createMenuItems(
IContextMenuInvocation invocation) {
//get selected requests from
//the invocation
IHttpRequestResponse[] ihrrs =
invocation.getSelectedMessages();
Defining Insertion Points

80. BurpExtender.createMenuItems()
//create clickable menu item
JMenuItem item = new JMenuItem(
"Send GWT request(s) to Intruder");
item.addActionListener(new MenuItemListener(ihrrs));
//return a Collection of menu items
List<JMenuItem> menuItems =
new ArrayList<JMenuItem>();
menuItems.add(item);
return menuItems;
Defining Insertion Points

81. MenuItemListener
class MenuItemListener implements ActionListener {
private IHttpRequestResponse[] ihrrs;
public MenuItemListener(
IHttpRequestResponse[] ihrrs) {
this.ihrrs = ihrrs;
}
public void actionPerformed(ActionEvent ae) {
sendGWTToIntruder(ihrrs);
}
}
Defining Insertion Points

82. BurpExtender.sendGWTToIntruder()
public void sendGWTToIntruder(IHttpRequestResponse[] ihrrs) {
for (IHttpRequestResponse baseRR : ihrrs) {
IHttpService service = baseRR.getHttpService();
// parse the request (not shown)
if (isGWTRequest) {
// Send GWT request to Intruder
callbacks.sendToIntruder(
service.getHost(), service.getPort(),
service.getProtocol().equals("https"),
request, insertionPointOffsets);
Defining Insertion Points

83. BurpExtender.sendGWTToIntruder()
baseRR.setComment(
"GWT: " + parser.getServiceMethod() +
" " +
baseRR.getComment()
);
Defining Insertion Points

84. Defining Insertion Points

85. Defining Insertion Points

86. Modifying Requests
• Add custom headers
• Add signatures
• CSRF tokens
Modifying Requests

87. Modifying Requests
• Implement IHttpListener
processHttpMessage()
• Register as an HTTP Listener
callbacks.registerHttpListener(this);
Modifying Requests

88. @Override
public void processHttpMessage(
int toolFlag, boolean messageIsRequest,
IHttpRequestResponse messageInfo) {
if (messageIsRequest &&
callbacks.TOOL_SCANNER == toolFlag) {
BurpExtender.processHttpMessage()
Modifying a Request

89. //see if the request contains a CSRF_TOKEN
byte[] scannerRequest =
messageInfo.getRequest();
String requestString =
helpers.bytesToString(scannerRequest);
Matcher matcher =
TOKEN_PATTERN.matcher(requestString);
if (matcher.find()) {
getFreshToken();
BurpExtender.processHttpMessage()
Modifying a Request

90. byte[] request =
helpers.buildHttpRequest(FORM_URL);
// issue the request and get the response
byte[] response = callbacks.makeHttpRequest(
DOMAIN_NAME, 443, true, request);
getFreshToken()
Modifying a Request

91. String responseString =
helpers.bytesToString(response);
Matcher matcher =
TOKEN_INPUT_PATTERN.matcher(responseString);
if (matcher.find()) return matcher.group(1);
getFreshToken()
Modifying a Request

92. String token = getFreshToken();
if (token != null) {
requestString = matcher.replaceAll(
"name="CSRF_TOKEN" value=" + token);
}
messageInfo.setRequest(
requestString.getBytes());
BurpExtender.processHttpMessage()
Modifying a Request

93. Debugging
• callbacks.printOutput(String)
• callbacks.printError(String)
Utilities

94. Utilities

95. Debugging – Stack Traces
• Exception.printStackTrace()
• Get the error OutputStream
• Print a stack trace to the stream
Utilities

96. Utilities

97. Bringing it all Together
• BApp Store Challenges
• Base Classes
• Passive Scanning
• GUI Building

98. Using Base Classes
• com.codemagi.burp.BaseExtender
– com.codemagi.burp.PassiveScan
• com.monikamorrow.burp.BurpSuiteTab
Bringing it all Together

99. Bringing it all Together
GUI Building

100. Passive Scanning
@Override
protected void initPassiveScan() {
//set the extension Name
extensionName = "Software Version Checks";
//create a component
rulesTable = new RuleTableComponent(this,
callbacks);
//add component to Burp GUI
mTab = new BurpSuiteTab(extensionName,
callbacks);
mTab.addComponent(rulesTable);
}
Bringing it all Together

101. Bringing it all Together
Solving BApp Store Challenges

102. Get the Code
• Burp Suite Utils:
– https://github.com/augustd/burp-suite-utils
• Burp Suite Extension Examples:
– https://github.com/monikamorrow/Burp-Suite-
Extension-Examples
• Software Version Checks
– https://github.com/augustd/burp-suite-software-
version-checks
• GWT Scan
– https://github.com/augustd/burp-suite-gwt-scan

103. Get the Extensions
• Software Version Checks
• GWT Scan
Also See:
• Error Message Checks
• Session Timeout Test
Available in the Bapp Store

104. Thank You!
August Detlefsen
augustd@codemagi.com
@codemagi
Monika Morrow
mmorrow@
appsecconsulting.com
@fortytwowho