lib/buby.rb in emonti-buby-1.1.3.1 vs lib/buby.rb in emonti-buby-1.1.4
- old
+ new
@@ -1,9 +1,10 @@
include Java
require 'pp'
require "buby.jar"
+require 'buby/extends.rb'
include_class 'BurpExtender'
# Buby is a mash-up of the commercial security testing web proxy PortSwigger
# Burp Suite(tm) allowing you to add scripting to Burp. Burp is driven from
@@ -76,11 +77,11 @@
# Buby-namer.
#
class Buby
# :stopdoc:
- VERSION = '1.1.3'
+ VERSION = '1.1.4'
LIBPATH = ::File.expand_path(::File.dirname(__FILE__)) + ::File::SEPARATOR
PATH = ::File.dirname(LIBPATH) + ::File::SEPARATOR
# :startdoc:
def initialize(other=nil)
@@ -224,11 +225,11 @@
_check_cb.includeInScope(url)
end
alias send_to_spider sendToSpider
alias spider sendToSpider
- # This method is a __send__ call back gate for the IBurpExtenderCallbacks
+ # This method is a __send__ callback gate for the IBurpExtenderCallbacks
# reference. It first checks to see if a method is available before calling
# with the specified arguments, and raises an exception if it is unavailable.
#
# This method was added for provisional calling of new callbacks added since
# Burp 1.2.09
@@ -241,37 +242,41 @@
raise "#{meth} is not available in your version of Burp"
end
cb.__send__ meth, *args
end
+
# Returns a Java array of IHttpRequestResponse objects pulled directly from
# the Burp proxy history.
def getProxyHistory
- _check_and_callback(:getProxyHistory)
+ HttpRequestResponseList.new(_check_and_callback(:getProxyHistory))
end
alias proxy_history getProxyHistory
alias get_proxy_history getProxyHistory
+
# Returns a Java array of IHttpRequestResponse objects pulled directly from
# the Burp site map for all urls matching the specified literal prefix.
# The prefix can be nil to return all objects.
def getSiteMap(urlprefix=nil)
- _check_and_callback(:getSiteMap, urlprefix)
+ HttpRequestResponseList.new(_check_and_callback(:getSiteMap, urlprefix))
end
alias site_map getSiteMap
alias get_site_map getSiteMap
+
# This method returns all of the current scan issues for URLs matching the
# specified literal prefix. The prefix can be nil to match all issues.
#
# IMPORTANT: This method is only available with Burp 1.2.15 and higher.
def getScanIssues(urlprefix=nil)
- _check_and_callback(:getScanIssues, urlprefix)
+ ScanIssuesList.new( _check_and_callback(:getScanIssues, urlprefix) )
end
alias scan_issues getScanIssues
alias get_scan_issues getScanIssues
+
# Restores Burp session state from a previously saved state file.
# See also: saveState
#
# IMPORTANT: This method is only available with Burp 1.2.09 and higher.
#
@@ -279,20 +284,22 @@
def restoreState(filename)
_check_and_callback(:restoreState, java.io.File.new(filename))
end
alias restore_state restoreState
+
# Saves the current Burp session to a state file. See also restoreState.
#
# IMPORTANT: This method is only available with Burp 1.2.09 and higher.
#
# * filename = path and filename of the file to save to
def saveState(filename)
_check_and_callback(:saveState, java.io.File.new(filename))
end
alias save_state saveState
+
# Parses a raw HTTP request message and returns an associative array
# containing parameters as they are structured in the 'Parameters' tab in the
# Burp request UI.
#
# IMPORTANT: This method is only available with Burp 1.2.09 and higher.
@@ -303,10 +310,11 @@
_check_and_callback(:getParameters, req)
end
alias parameters getParameters
alias get_parameters getParameters
+
# Parses a raw HTTP message (request or response ) and returns an associative
# array containing the headers as they are structured in the 'Headers' tab
# in the Burp request/response viewer UI.
#
# IMPORTANT: This method is only available with Burp 1.2.09 and higher.
@@ -508,11 +516,12 @@
#
# Note: this method maps to the processHttpMessage BurpExtender Java method.
#
# This method should be overridden if you wish to implement functionality
# relating to generalized requests and responses from any BurpSuite tool.
- # You may want to use evt_proxy_message if you only intend to work with only
+ #
+ # You may want to use evt_proxy_message if you only intend to work on
# proxied messages. Note, however, the IHttpRequestResponse Java object is
# not used in evt_proxy_message and gives evt_http_message a somewhat
# nicer interface to work with.
#
# Parameters:
@@ -521,11 +530,12 @@
# * is_request = boolean true = request / false = response
#
# * message_info = an instance of the IHttpRequestResponse Java class with
# methods for accessing and manipulating various attributes of the message.
#
- def evt_http_message tool_name, is_request, message_info
+ def evt_http_message(tool_name, is_request, message_info)
+ HttpRequestResponseHelper.implant(message_info)
pp([:got_http_message, tool_name, is_request, message_info]) if $DEBUG
end
# This method is invoked whenever Burp Scanner discovers a new, unique
# issue, and can be used to perform customised reporting or logging of
@@ -538,10 +548,11 @@
#
# Parameters:
# * issue = an instance of the IScanIssue Java class with methods for viewing
# information on the scan issue that was generated.
def evt_scan_issue(issue)
+ ScanIssueHelper.implant(issue)
pp([:got_scan_issue, issue]) if $DEBUG
end
# This method is called by BurpExtender right before closing the
# application. Implementations can use this method to perform cleanup
@@ -559,11 +570,11 @@
# If a statefile argument isn't specified current burp session state is used.
#
# Yields each entry in the site map to a block (which is required)
def with_site_map(urlprefix=nil, statefile=nil)
with_statefile(statefile) do |this|
- this.site_map(urlprefix).to_a.each {|h| yield h}
+ this.site_map(urlprefix).each {|h| yield h }
end
end
# This is a convenience wrapper which can load a given burp state file and
# lets its caller to perform actions inside of a block on the proxy history
@@ -572,18 +583,17 @@
# If a statefile argument isn't specified current burp session state is used.
#
# Yields each entry in the proxy history to a block (which is required)
def with_proxy_history(statefile=nil)
with_statefile(statefile) do |this|
- this.proxy_history.to_a.each {|h| yield h }
+ this.proxy_history.each {|h| yield h }
end
end
# This is a convenience wrapper which loads a given burp statefile and lets
- # its caller to perform actions with burp on it inside of a block.
- # It expects a block to yield 'self' is yielded for the duration
- # of the statefile load.
+ # its caller perform actions via burp while its loaded on it inside of a
+ # block. The old state is restored after the block completes.
#
# It can safely be used without a statefile argument, in which case the
# current session state is used.
#
# It can safely be run without a statefile argument in which the
@@ -591,14 +601,13 @@
def with_statefile(statefile=nil)
if statefile
# save current state:
old_state=".#{$$}.#{Time.now.to_i}.state.bak"
self.alert "Saving current state to temp statefile: #{old_state}"
- self.save_state old_state
-
+ self.save_state(old_state)
self.alert "Restoring state: #{statefile}"
- self.restore_state statefile
+ self.restore_state(statefile)
end
yield self
if statefile
@@ -617,22 +626,15 @@
# state will be used if statefile is nil.
#
# This method also accepts an optional block which is passed each of the
# matched history members.
def search_proxy_history(statefile=nil, urlrx=nil)
- ret = nil
- with_statefile(statefile) do |this|
- ret = this.proxy_history.to_a.select do |r|
- if urlrx
- true if r.url.to_s =~ urlrx
- else
- true
- end
+ ret = []
+ with_proxy_history(statefile) do |r|
+ if (not urlrx) or r.url.to_s =~ urlrx
+ ret << r if (not block_given?) or yield(r)
end
- if block_given?
- ret.each {|r| yield r }
- end
end
return ret
end
# Harvest cookies from a session's proxy history.
@@ -642,15 +644,14 @@
# urlrx = optional: regular expression to match urls against
# statefile = optional: filename for a burp session file to temporarily load
# and harvest from.
def harvest_cookies_from_history(cookie=nil, urlrx=nil, statefile=nil)
ret = []
- search_proxy_history(statefile, urlrx) do |msg|
- rsp = String.from_java_bytes(msg.response)
- found = []
- find_cookie_in_response(rsp, cookie) {|c| found << c}
- ret += found.map {|f| f << msg }
+ search_proxy_history(statefile, urlrx) do |hrr|
+ ret += hrr.rsp_headers.select do |h|
+ h[0].downcase == 'set-cookie'
+ end.map{|h| h[1]}
end
return ret
end
### Startup stuff
@@ -734,9 +735,10 @@
def self.version
VERSION
end
end # Buby
+
# Try requiring 'burp.jar' from the Ruby lib-path
unless Buby.burp_loaded?
begin require "burp.jar"
rescue LoadError