Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Hidden API for IHttpRequestResponse objects?

Nicolas | Last updated: Apr 14, 2015 08:42AM UTC

Hello, I found a suprising behavior in the Extender API (using Jython). Because of a typo, I called getUrl() on some IHttpRequestResponse objects... and it worked! Given the API documentation (both online http://portswigger.net/burp/extender/api/burp/IHttpRequestResponse.html or in-app), there's no function with that name in these objects. In fact, getUrl() exists only for IRequestInfo objects (and may not work, depending on which analyzeRequest() is used). Documented way: for message in invocation.getSelectedMessages(): print helpers.analyzeRequest(message).getUrl() Un-documented way: for message in invocation.getSelectedMessages(): print message.getUrl() Am I missing something obvious? Or is this call really undocumented? Note: IScanIssue.getUrl() exists too, but that's different...

PortSwigger Agent | Last updated: Apr 14, 2015 08:50AM UTC

Yes, there are a few undocumented methods on IHttpRequestResponse - get/setters for host/port/protocol/url. These were originally full methods on the interface, but they were removed a long time ago during an API revamp. Instead, we provided some util methods in IExtensionHelpers to analyze an HTTP request/response and give you these details. Removing the methods from IHttpRequestResponse made it much easier to for extension writers to create their own IHttpRequestResponse objects, without needing to implement those helper methods again. To ensure backwards binary compatibility with legacy extensions, Burp still supports those methods under the hood on any IHttpRequestResponse objects that it creates. We thought of this as a kind of "turbo deprecation", and it is not recommended to use those legacy methods because they might be fully removed in future.

Burp User | Last updated: Apr 14, 2015 09:30AM UTC

Thanks for the quick feedback, I'll move my code to the documented way. Btw, why not logging a "deprecated" warning? I'd have realized my mistake earlier...

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.