Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Scanner vs processHttpMessage (python)

Zoltan | Last updated: Nov 17, 2015 08:54AM UTC

Dear All, I have the following processHttpMessage() function to modify the scanner requests and check SQLi: def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo): # only process requests if messageIsRequest and toolFlag == callbacks.TOOL_SCANNER: if self._helpers.analyzeRequest(messageInfo.getRequest()).getMethod() == 'GET': method = IParameter.PARAM_URL else: method = IParameter.PARAM_BODY path = self._helpers.analyzeRequest(messageInfo).getUrl().getPath() if '.' in path: ext = path.split('.')[-1] else: ext = '' if (ext in ['cgi','pl']): parameters = self._helpers.analyzeRequest(messageInfo.getRequest()).getParameters() for parameter in parameters: messageInfo.setRequest(self._helpers.updateParameter(messageInfo.getRequest(), self._helpers.buildParameter(parameter.getName(),"'"+parameter.getValue(),method))) newParam = self._helpers.buildParameter(parameter.getName(),'2',method) messageInfo.setRequest(self._helpers.addParameter(messageInfo.getRequest(), newParam)) return My problem is the following: The scanner is properly discovered the SQLi vulnerability but the issue contains wrong information (before the modification): Reported URL: /cgi-bin/a.cgi?user=root'%20and%20(select*from(select(sleep(20)))a)--%20 Expected URL: /cgi-bin/a.cgi?user='root'%20and%20(select*from(select(sleep(20)))a)--%20&user=2 How can I solve this problem? Can I send the modified request to the scanner engine? I would not like to write the whole SQLi detection in a new doActiveScan(). Thank you!

Burp User | Last updated: Nov 17, 2015 06:16PM UTC