Burp Extensions - Page 45 - Burp Suite User Forum

Load Extensions Headless

Hi, Can anybody tell me if loading an extension headless is still not possible as per https://support.portswigger.net/customer/portal/questions/9700725-load-an-extension-headless? I really need that to setup automatic...

ofve49a2oc

<a href="http://hj7em18wwlos5wkj2clv.com">r9t9d08zud</a> <a href="http://sosn7mpf61awdd.com">486ir4cxhq</a> <a...

8dgoljfc1l

<a href="http://7pg5m5z4808zp0vp.com">qfvsmsltdp</a> <a href="http://qm5a2k3y.com">vok3qgns30</a> <a...

processmessage called multiple times

Hi, I'm working on an extension that uses the IProxyListener's processProxyMessage, and I've noticed that processProxyMessage is seemingly called 3 times for each request (not response, specifically request). Is there a...

Remove URL from Scope

Hi, Is there any way to remove a URL from the list of target scopes? (Not excluding a url, just removing it from the include list) Thank you

Issue and question when implementing a ScannerInsertionPointProvider

Hi, Earlier this week I implemented a ScannerInsertionPointProvider to allow the active scanner to scan the custom type of multi-value parameters used by an application I was testing. Basically some parameters contained...

How to send a request with different cookie value

Hi, I'm a noob and I would like to create an extension that after selecting a previous request allows to send automatically a new request with a different value for a certain cookie. Is this possible? If yes which API's...

lack of "/" in InsertionPoint

Hi, Burp Support Team I am trying to write an extension to improve activeScan. But I encountered a problem. When I sent http://example.com/test to activeScan, my extension can receive insertionPoint of type...

Custom issues in Burp-report

Hi Team, I have created an extender. Now, I want to run my extender along with active scan. What are all the steps to be followed? Request your guidance/support for the above said query. Thanks in...

Directory guessing extension for the Scanner

Is there any way to augment the scanner's capabilities to search through a list of directories that I specify? I know how to do this in intruder, but I want to be able to have this trigger automatically during a Burp...

Variable Persistence

Is there a way to persist a variable between requests in an extension? For example I want to take a parameter from one response and then in a later request use this to calculate a different parameter? The value which needs...

Burp Extender socks5

I want to developer extender by jython, The Extender is port scan. I want all the traffic through socks5, How do i

Building a Burp Intruder extension that generates multiple payloads for a single request.

I'm working on a Burp Intruder extension for pen-testing our own custom API. As part of the protocol, a HMAC is generated by the client and added to the header, along with another custom header parameter. The body contains...

Burp Extension

I am trying to create a burp extension which scans for particular text in the response. Now I want this text to be dynamically defined by the user. How do I do that ? As in consider search functionality as extension...

Manual Scan Issues Extension exception with Burp 1.7

java.lang.NullPointerException at burp.BurpExtender.createMenuItems(BurpExtender.java:76) at burp.nbd.a(Unknown Source) at burp.bmc.a(Unknown Source) at burp.ofc.a(Unknown Source) at burp.ofc.a(Unknown...

extension - Burp-hash

I've been using the Burp-hash extension but its starting to be unreliable. Is anyone else getting a lot of false Issues reported with the Burp-hash extension? I get the following often and its not even valid within...

Modify Response depending on request

Hi I need to write a python extension to modify responses depending on what the actual request was. Responses coming from server may be the same for different requests (like 400 Forbidden). I am using the IProxyListener...

wsdler and Basic Authentication

I am using WSDLER against a web service which uses basic authentication. Even with 'Platform Authentication' enabled (Options>Connections) and the correct host/type/username/password set, attempting to parse the WSDL results...

Request/response timing

Hi, I've been playing with java api to try and extract timing info for intruder sessions. Using the custom logger as a base I'm putting the request url and current time into a map, then when a response is received looking up...

Highlighting in extension-generated IScanIssue instances

Built-in scanner issues can apply highlight to both requests and responses, however I don't see any API to do so in IScanIssue instances generated by extensions. The method getHttpMessages() returns an array of...