Burp Suite User Forum

Login to post

Highlighting in the Text Editor

Nerix | Last updated: Aug 04, 2020 12:35PM UTC

In newer versions of Burp, the text editor highlights the request and response. Now for extensions it would be nice to "hook" into this process or replicate it in the TextEditor. I've tried to add <html> at the start of the message ( https://docs.oracle.com/javase/tutorial/uiswing/components/html.html ), but it didn't work. I'm not really familiar with Java Swing.

Uthman, PortSwigger Agent | Last updated: Aug 04, 2020 01:05PM UTC

Hi, Are you referring to the Message Editor highlighting a snippet of the request/response when a scan issue is reported? What are you trying to do?

August | Last updated: Aug 07, 2020 08:35PM UTC

I think you may be looking for IBurpExtenderCallbacks.applyMarkers(): https://portswigger.net/burp/extender/api/burp/IBurpExtenderCallbacks.html#applyMarkers(burp.IHttpRequestResponse,%20java.util.List,%20java.util.List)

Hannah, PortSwigger Agent | Last updated: Aug 10, 2020 08:57AM UTC

applyMarkers will only provide highlighting in certain situations, such as specifying Intruder payload positions, Scanner insertion points, and highlights in Scanner issues, rather than in the general editor. If you implement IMessageEditor, syntax highlighting will available by default.

gnothi | Last updated: Aug 15, 2020 06:37AM UTC

I presume you talk about iTextEditor and how it doesn't do the highlighting as the rest of burp does? I'm not sure if it can be activated, but I don't have high hopes for it. What I learned from coding extensions is that when it comes to the interface, a lot of what you expect should work, actually requires manual labor to do it. Like if you apply a iHttpRequestResponse.setHighlight() it will be colored in all burp tables, but not your own and you'll have to write a manual TableCellRenderer to get that behavior. I don't see why the API couldn't make a TableCellRenderer available or a table that applies that capabilities. Anyway the Api is kinda nice, just don't expect too much magic in the visual department. I'd be inclined to think that if you want some sort of highlighting, you'll have to make it happen yourself... hope I'm wrong though. Let me know if I am.

You need to Log in to post a reply. Or register here, for free.