Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Highlighting in the Text Editor

Nerix | Last updated: Aug 04, 2020 12:35PM UTC

In newer versions of Burp, the text editor highlights the request and response. Now for extensions it would be nice to "hook" into this process or replicate it in the TextEditor. I've tried to add <html> at the start of the message ( https://docs.oracle.com/javase/tutorial/uiswing/components/html.html ), but it didn't work. I'm not really familiar with Java Swing.

Uthman, PortSwigger Agent | Last updated: Aug 04, 2020 01:05PM UTC

Hi, Are you referring to the Message Editor highlighting a snippet of the request/response when a scan issue is reported? What are you trying to do?

August | Last updated: Aug 07, 2020 08:35PM UTC

I think you may be looking for IBurpExtenderCallbacks.applyMarkers(): https://portswigger.net/burp/extender/api/burp/IBurpExtenderCallbacks.html#applyMarkers(burp.IHttpRequestResponse,%20java.util.List,%20java.util.List)

Hannah, PortSwigger Agent | Last updated: Aug 10, 2020 08:57AM UTC

applyMarkers will only provide highlighting in certain situations, such as specifying Intruder payload positions, Scanner insertion points, and highlights in Scanner issues, rather than in the general editor. If you implement IMessageEditor, syntax highlighting will available by default.

gnothi | Last updated: Aug 15, 2020 06:37AM UTC

I presume you talk about iTextEditor and how it doesn't do the highlighting as the rest of burp does? I'm not sure if it can be activated, but I don't have high hopes for it. What I learned from coding extensions is that when it comes to the interface, a lot of what you expect should work, actually requires manual labor to do it. Like if you apply a iHttpRequestResponse.setHighlight() it will be colored in all burp tables, but not your own and you'll have to write a manual TableCellRenderer to get that behavior. I don't see why the API couldn't make a TableCellRenderer available or a table that applies that capabilities. Anyway the Api is kinda nice, just don't expect too much magic in the visual department. I'd be inclined to think that if you want some sort of highlighting, you'll have to make it happen yourself... hope I'm wrong though. Let me know if I am.

Björn | Last updated: Jun 13, 2023 07:42AM UTC

Is there still no good way to achieve this? Hannah's reply above suggests it should be possible and even automatic, but that's not my experience in practice. I usually build extensions that implement the IMessageEditorTab interface in order to add a tab that allows me to read and modify request data that is encrypted or encoded in some way that Burp doesn't handle natively. Since this data is often something like JSON or regular POST parameters once decrypted/decoded, but I don't know how Burp would know that without doing some form of content sniffing.

Björn | Last updated: Jun 13, 2023 07:48AM UTC

I meant to say: Since this data is often something like JSON or regular POST parameters once decrypted/decoded, it would be nice to make it more readable with syntax highlighting. I imagine I might have to specify that somehow though, unless Burp does content sniffing.

Hannah, PortSwigger Agent | Last updated: Jun 16, 2023 09:11AM UTC

We've raised a feature request to better expose syntax highlighting in the Montoya API. You could also use a library, like RSyntaxTextArea. If there are any existing extensions that contain the functionality you wish to add to your own extension, you can check out the code behind them. All BApp Store extensions have their code publicly available on Github here: https://github.com/PortSwigger

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.