So You Want to Build a Burp Plugin?

Transcription

1 So You Want to Build a Burp Plugin? Monika Morrow, Senior Security Consultant at AppSec Consulting Inc. December 6, 2013

2 Why Burp Plugins? Eliminate annoyances Status notifications, default settings, auto-scope Ensure thoroughness Custom scan checks/issues Overcome obstacles Compute and add signatures, custom headers Add custom functionality Custom display formatting, trigger alerts

3 Burp Extender 2012 Updates Significantly expanded API Over 30 new classes available Multiple extension support Use multiple task-oriented plugins instead of a single, monolithic plugin Dynamic loading/unloading Pause use of plugin without restarting Burp Auto-reload

4 Burp Extender API 37 classes available for purposes such as: Processing HTTP requests/responses Accessing runtime data Managing scope Interacting with the cookie jar Adding interface items Helper classes to parse requests/responses

5 Burp Extender API

6 Let s Get Started A programmer with little experience should be able to create a useful plugin of their own using concepts from the example plugins created today: Proxy Traffic/Find & Replace Add Menu to Proxy History Scan Alert

7 Recommended Set Up Current NetBeans IDE (7.4) Ships with Java JDK (1.7.0_25) PortSwigger provided NetBeans empty project

8 Proxy Traffic/Find & Replace

9 Proxy Traffic/Find & Replace A plugin that examines each request to the proxy tool, and if the target string is found, replace it with a dynamic value In this example the target string ReplaceMe will be replaced with the time in milliseconds

10 Proxy Traffic/Find & Replace System Preparation Unzip the EmptyExtenstion NetBeans project to a new folder named FindReplace In NetBeans, open the BurpExtender project located in the FindReplace folder Expand the project tree and open the BurpExtender.java code file in the NetBeans editor

11 Proxy Traffic/Find & Replace

12 Proxy Traffic/Find & Replace

13 Proxy Traffic/Find & Replace

14 Proxy Traffic/Find & Replace Add the following line of code to registerextendercallbacks: callbacks.setextensionname("find & Replace"); Now you re ready to compile and test

15 Proxy Traffic/Find & Replace

16 Proxy Traffic/Find & Replace

17 Proxy Traffic/Find & Replace

18 Proxy Traffic/Find & Replace Import the PrintWriter library and create member versions of the StdOut and StdErr provided by Burp import java.io.printwriter; private PrintWriter mstdout; private PrintWriter mstderr; mstdout = new PrintWriter(callbacks.getStdout(), true); mstderr = new PrintWriter(callbacks.getStderr(), true);

19 Proxy Traffic/Find & Replace Call registerhttplistener with this class callbacks.registerhttplistener(this); Implement IHttpListener by overriding processhttpmessage public class BurpExtender implements IBurpExtender, public void processhttpmessage(int toolflag, boolean messageisrequest, IHttpRequestResponse messageinfo) { }

20 Proxy Traffic/Find & Replace Add a message to StdOut to show the overridden method is being called mstdout.println("processhttpmessage called"); At this point every request and response from every tool handled by Burp is being routed through the plugin

21 Proxy Traffic/Find & Replace

22 Proxy Traffic/Find & Replace Choose which tools/requests should be handled by processhttpmessage if(toolflag == IBurpExtenderCallbacks.TOOL_PROXY) { } if(messageisrequest) { }...

23 Proxy Traffic/Find & Replace Add a method to be called when proxy messages are received private IHttpRequestResponse MyCustomFunctionFindReplace(IHttpRequestResponse { } Return messageinfo to the caller return messageinfo; messageinfo)

24 Proxy Traffic/Find & Replace Call MyCustomFunctionFindReplace from processhttpmessage messageinfo = MyCustomFunctionFindReplace(messageInfo); In the MyCustomFunctionFindReplace method convert the byte[] Request to a String for processing String message = new String(messageInfo.getRequest());

25 Proxy Traffic/Find & Replace Create values for the target text, replacement text, and new request message String search = "ReplaceMe"; String replace = "" + System.currentTimeMillis(); StringBuilder newstring = new StringBuilder( message.length() search.length() + replace.length());

26 Proxy Traffic/Find & Replace Add try/catch blocks for processing and print any exceptions to Burp s StdErr try { } catch (Exception e) { } mstderr.println("error replacing text: " + e.getmessage());

27 Proxy Traffic/Find & Replace Add Find/Replace code to try block BufferedReader reader = new BufferedReader( new StringReader(message)); String line; while((line = reader.readline())!= null) { if(line!= null) { if(line.contains(search)) { line = line.replaceall(search, replace); } newstring.append(line).append("\r\n"); } }

28 Proxy Traffic/Find & Replace Set the new string as a byte[] request value for Burp to send messageinfo.setrequest(newstring.tostring().getbytes()); The Proxy Traffic/Find & Replace plugin is now complete

29 Proxy Traffic/Find & Replace

30 Proxy Traffic/Find & Replace

31 Proxy Traffic/Find & Replace

32 Proxy Traffic/Find & Replace

33 Add Menu to Proxy History

34 Add Menu to Proxy History A plugin that adds a menu option to the right click context menu of the proxy history This menu allows each selected item to be checked for scope, added if desired, sent to the scanner and then highlighted and commented for tracking

35 Add Menu to Proxy History System Preparation As before, unzip the EmptyExtenstion NetBeans project to a new folder named AddMenu In NetBeans open the BurpExtender project located in the AddMenu folder Expand the project tree and open BurpExtender.java in the editor

36 Add Menu to Proxy History Add the following line of code to registerextendercallbacks callbacks.setextensionname( Add Menu"); We need callbacks to be available to us later so we ll save it in a member variable private IBurpExtenderCallbacks mcallbacks; mcallbacks = callbacks;

37 Add Menu to Proxy History Call registercontextmenufactory with this class callbacks.registercontextmenufactory(this); Implement IContextMenuFactory by overriding createmenuitems public class BurpExtender implements IBurpExtender, public List<JMenuItem> createmenuitems(icontextmenuinvocation invocation) { }

38 Add Menu to Proxy History In the createmenuitems method create a List of JMenuItems and return it import java.util.list; import javax.swing.jmenuitem; import java.util.arraylist; List<JMenuItem> menulist = new ArrayList<>(); return menulist;

39 Add Menu to Proxy History Create a member variable to store the invocation passed to createmenuitems private IContextMenuInvocation minvocation; minvocation = invocation;

40 Add Menu to Proxy History Check if the context is right to show the menu, create and name the JMenuItem to be added, and add the new menu item to the list if(minvocation.getinvocationcontext() == } IContextMenuInvocation.CONTEXT_PROXY_HISTORY) { JMenuItem markscan = new JMenuItem("Mark & Scan"); menulist.add(markscan);

41 Add Menu to Proxy History Insert an ActionListener to markscan before it is added to the list and override actionperformed to check for our event import java.awt.event.actionevent; import java.awt.event.actionlistener; markscan.addactionlistener(new ActionListener() public void actionperformed(actionevent arg0) { if(arg0.getactioncommand().equals("mark & Scan")){...} } });

42 Add Menu to Proxy History Add a method to be called when the custom JMenuItem is selected private void MarkAndScan(IHttpRequestResponse[] messages) { } Call it from the newly created actionlistener MarkAndScan(mInvocation.getSelectedMessages());

43 Add Menu to Proxy History In the MarkAndScan method iterate through each message in the passed IHttpRequestResponse array for(int i=0; i < messages.length; i++) { }

44 Add Menu to Proxy History Add a try/catch block and print an error to the Burp Errors window import java.io.printwriter; try { }// try catch (Exception e) { PrintWriter stderr = new PrintWriter(mCallbacks.getStderr(), true); stderr.println("error creating URL: " + e.getmessage()); }

45 Add Menu to Proxy History Create a URL from the message to be used to check and update Burp s scope URL url = new URL( messages[i].gethttpservice().getprotocol(), messages[i].gethttpservice().gethost(), messages[i].gethttpservice().getport(), "");

46 Add Menu to Proxy History Pass the URL to the IBurpExtenderCallbacks helper method isinscope to determine if we can proceed if(!mcallbacks.isinscope(url)) { }

47 Add Menu to Proxy History If it isn t in scope ask if the user would like to add it and add to scope if requested import javax.swing.joptionpane; int ans = JOptionPane.showConfirmDialog(null, "This item is not in scope. Would you like to add it?\r\n + url.tostring(), "Add to Scope?", JOptionPane.YES_NO_OPTION); if(ans == JOptionPane.YES_OPTION) { } mcallbacks.includeinscope(url);

48 Add Menu to Proxy History Check again if the URL is in scope and if so send the request to the scanner if(mcallbacks.isinscope(url)) { } mcallbacks.doactivescan( messages[i].gethttpservice().gethost(), messages[i].gethttpservice().getport(), messages[i].gethttpservice().getprotocol(). messages[i].getrequest()); equalsignorecase("https"),

49 Add Menu to Proxy History Modify the request that was sent to the scanner to be highlighted pink in the proxy history and change the comment to Sent to Scanner messages[i].sethighlight("pink"); messages[i].setcomment("sent to scanner");

50 Add Menu to Proxy History

51 Add Menu to Proxy History

52 Add Menu to Proxy History

53 Add Menu to Proxy History

54 Add Menu to Proxy History

55 Scan Alert

56 Scan Alert This plugin monitors the status of the scanner and alerts the user with sound and an alert box when no scanning activity has taken place for over 30 seconds

57 Scan Alert System Preparation As before, unzip the EmptyExtenstion NetBeans project to a new folder named ScanAlert In NetBeans open the BurpExtender project located in the ScanAlert folder Expand the project tree and open BurpExtender.java in the editor

58 Scan Alert Register the extension callbacks.setextensionname( Scan Alert"); Create a member variable mscantime to track the last known activity of the scanner and set its initial value to zero private long mscantime; mscantime = 0;

59 Scan Alert Call registerhttplistener with this class callbacks.registerhttplistener(this); Implement IHttpListener by overriding processhttpmessage public class BurpExtender implements IBurpExtender, public void processhttpmessage(int toolflag, boolean messageisrequest, IHttpRequestResponse messageinfo) { }

60 Scan Alert Every time the scanner sends a request update mscantime with the current time if(toolflag == IBurpExtenderCallbacks.TOOL_SCANNER && { } messageisrequest) mscantime = System.currentTimeMillis();

61 Scan Alert Implement a timer to check/manage the status of the mscantime timestamp public class BurpExtender extends TimerTask implements IBurpExtender, IHttpListener private Timer mtimer; mtimer = new Timer(); mtimer.scheduleatfixedrate(this, 0, public void run() { }

62 Scan Alert Set timer to check if scanner is running (nonzero) and if the last update was more than thirty seconds ago if(mscantime > 0 && { } (System.currentTimeMillis() mscantime) > 30000)

63 Scan Alert Alert that scanning is finished and reset the mscantime variable Toolkit.getDefaultToolkit().beep(); JOptionPane.showMessageDialog(null, mscantime = 0; "Scanner is finished!", "Scanner Finished", JOptionPane.INFORMATION_MESSAGE);

64 Scan Alert

65 Questions?

66 So You Want to Build a Burp Plugin? Source code available on GitHub Slides available on AppSec Consulting Blog