Skip to content

Commit 6b0a737

Browse files
c0ny1c0ny1
committed
第一次添加
1 parent def7d13 commit 6b0a737

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+4018
-23
lines changed

‎LICENSE‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
MIT License
2-
3-
Copyright (c) 2019 残亦
4-
5-
Permission is hereby granted, free of charge, to any person obtaining a copy
6-
of this software and associated documentation files (the "Software"), to deal
7-
in the Software without restriction, including without limitation the rights
8-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9-
copies of the Software, and to permit persons to whom the Software is
10-
furnished to do so, subject to the following conditions:
11-
12-
The above copyright notice and this permission notice shall be included in all
13-
copies or substantial portions of the Software.
14-
15-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21-
SOFTWARE.
1+
MIT License
2+
3+
Copyright (c) 2019 残亦
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,14 @@
1-
# chunked-coding-converter
2-
Burp suite 分块传输辅助插件
1+
# chunked-coding-converter|Burp suite 分块传输辅助插件
2+
3+
本插件主要用于分块传输绕WAF，不了解分块传输绕WAF的请阅读文末的文章。
4+
5+
## 插件使用
6+
7+
![菜单](doc/menu.png)
8+
9+
![配置](doc/config.png)
10+
11+
## 相关文章
12+
* [利用分块传输吊打所有WAF](https://www.anquanke.com/post/id/169738)
13+
* [在HTTP协议层面绕过WAF](https://www.freebuf.com/news/193659.html)
14+
* [编写Burp分块传输插件绕WAF](https://mp.weixin.qq.com/s?__biz=Mzg3NjA4MTQ1NQ==&mid=2247483787&idx=1&sn=54c33727696f8ee6d67f997acc11ab89&chksm=cf36f9cbf84170dd7da9b48b3365fb05d7ccec6bdeff480d0c38962f712e400a40b2b38dc467&token=360242838&lang=zh_CN#rd)

‎doc/config.png‎

13.4 KB
Loading

‎doc/menu.png‎

8.24 KB
Loading

‎src/burp/BurpExtender.java‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
package burp;
2+
3+
4+
import java.io.PrintWriter;
5+
import java.net.URL;
6+
import java.util.concurrent.ExecutorService;
7+
import java.util.concurrent.Executors;
8+
import java.util.concurrent.ScheduledExecutorService;
9+
10+
public class BurpExtender implements IBurpExtender,IHttpListener,IProxyListener {
11+
private IBurpExtenderCallbacks callbacks;
12+
private IExtensionHelpers helpers;
13+
private String extensionName = "chunked-converter";
14+
private String version ="0.1";
15+
private PrintWriter stdout;
16+
private PrintWriter stderr;
17+
private ScheduledExecutorService executor = Executors.newSingleThreadScheduledExecutor();
18+
private ExecutorService executorService = Executors.newSingleThreadExecutor();
19+
@Override
20+
public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {
21+
this.callbacks = callbacks;
22+
this.helpers = callbacks.getHelpers();
23+
callbacks.setExtensionName(String.format("%s %s",extensionName,version));
24+
callbacks.registerContextMenuFactory(new Menu(callbacks));
25+
callbacks.registerHttpListener(this);
26+
callbacks.registerProxyListener(this);
27+
stdout = new PrintWriter(callbacks.getStdout(),true);
28+
stderr = new PrintWriter(callbacks.getStderr(),true);
29+
stdout.println(getBanner());
30+
}
31+
32+
@Override
33+
public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {
34+
//代理不走这，否则两次修改会导致数据包存在问题
35+
if(messageIsRequest && isValidTool(toolFlag) && (toolFlag != IBurpExtenderCallbacks.TOOL_PROXY)){
36+
IRequestInfo reqInfo = helpers.analyzeRequest(messageInfo.getRequest());
37+
//stdout.println(messageInfo.getRequest().toString());
38+
//stdout.println(reqInfo.getContentType());
39+
//stdout.println(reqInfo.getMethod());
40+
41+
if(reqInfo.getMethod().equals("POST") && reqInfo.getContentType() == IRequestInfo.CONTENT_TYPE_URL_ENCODED){
42+
try {
43+
byte[] request = Transfer.encoding(helpers, messageInfo, Config.splite_len,Config.isComment);
44+
if (request != null) {
45+
messageInfo.setRequest(request);
46+
}
47+
} catch (Exception e) {
48+
stderr.println(e.getMessage());
49+
}
50+
}
51+
}
52+
}
53+
54+
@Override
55+
public void processProxyMessage(final boolean messageIsRequest, final IInterceptedProxyMessage proxyMessage) {
56+
if(messageIsRequest && isValidTool(IBurpExtenderCallbacks.TOOL_PROXY)){
57+
IHttpRequestResponse messageInfo = proxyMessage.getMessageInfo();
58+
IRequestInfo reqInfo = helpers.analyzeRequest(messageInfo.getRequest());
59+
60+
if(reqInfo.getMethod().equals("POST") && reqInfo.getContentType() == IRequestInfo.CONTENT_TYPE_URL_ENCODED){
61+
try {
62+
byte[] request = Transfer.encoding(helpers, messageInfo, Config.splite_len,Config.isComment);
63+
if (request != null) {
64+
messageInfo.setRequest(request);
65+
}
66+
} catch (Exception e) {
67+
stderr.println(e.getMessage());
68+
}
69+
}
70+
}
71+
}
72+
73+
private boolean isValidTool(int toolFlag){
74+
return (Config.act_on_all_tools ||
75+
(Config.act_on_proxy && toolFlag== IBurpExtenderCallbacks.TOOL_PROXY) ||
76+
(Config.act_on_intruder && toolFlag== IBurpExtenderCallbacks.TOOL_INTRUDER) ||
77+
(Config.act_on_repeater && toolFlag== IBurpExtenderCallbacks.TOOL_REPEATER) ||
78+
(Config.act_on_scanner && toolFlag== IBurpExtenderCallbacks.TOOL_SCANNER) ||
79+
(Config.act_on_sequencer && toolFlag== IBurpExtenderCallbacks.TOOL_SEQUENCER) ||
80+
(Config.act_on_spider && toolFlag== IBurpExtenderCallbacks.TOOL_SPIDER) ||
81+
(Config.act_on_extender && toolFlag== IBurpExtenderCallbacks.TOOL_EXTENDER) ||
82+
(Config.act_on_target && toolFlag== IBurpExtenderCallbacks.TOOL_TARGET));
83+
}
84+
85+
public String getBanner(){
86+
String bannerInfo =
87+
"[+]\n"
88+
+ "[+] ###############################################\n"
89+
+ "[+] " + extensionName + " v" + version +"\n"
90+
+ "[+] anthor: c0ny1\n"
91+
+ "[+] email: [email protected]\n"
92+
+ "[+] github: http://github.com/c0ny1/chunked-coding-converter\n"
93+
+ "[+] ##############################################";
94+
return bannerInfo;
95+
}
96+
}

‎src/burp/Config.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package burp;
2+
3+
public class Config {
4+
public static int splite_len = 2;
5+
public static boolean isComment = true;
6+
public static boolean act_on_all_tools = false;
7+
public static boolean act_on_target = false;
8+
public static boolean act_on_proxy = false;
9+
public static boolean act_on_spider = false;
10+
public static boolean act_on_intruder = false;
11+
public static boolean act_on_repeater = false;
12+
public static boolean act_on_scanner = false;
13+
public static boolean act_on_extender = false;
14+
public static boolean act_on_sequencer = false;
15+
}

‎src/burp/ConfigDlg.java‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
package burp;
2+
3+
import javax.swing.*;
4+
import java.awt.*;
5+
import java.awt.event.ActionEvent;
6+
import java.awt.event.ActionListener;
7+
8+
public class ConfigDlg extends JDialog {
9+
private final JPanel mainPanel = new JPanel();
10+
private final JPanel topPanel = new JPanel();
11+
private final JPanel centerPanel = new JPanel();
12+
private final JPanel bottomPanel = new JPanel();;
13+
private final JLabel lbSplitLen = new JLabel("Split length:");;
14+
private final JSpinner spSplitLen = new JSpinner(new SpinnerNumberModel(2, 1, 100, 1));
15+
private final JLabel lbRange = new JLabel("(1-100)");
16+
private final JCheckBox cbComment = new JCheckBox("Is Comment");
17+
private final JLabel lbActOnModel = new JLabel("Act on:");
18+
private final JCheckBox chkAllTools = new JCheckBox("All Tools");
19+
private final JCheckBox chkSpider = new JCheckBox("Spider");
20+
private final JCheckBox chkIntruder = new JCheckBox("Intruder");
21+
private final JCheckBox chkScanner = new JCheckBox("Scanner");
22+
private final JCheckBox chkRepeater = new JCheckBox("Repeater");
23+
private final JCheckBox chkSequencer = new JCheckBox("Sequencer");
24+
private final JCheckBox chkProxy = new JCheckBox("Proxy");
25+
private final JCheckBox chkExtender = new JCheckBox("Extender");
26+
private final JCheckBox chkTarget = new JCheckBox("Target");
27+
private final JButton btCancel = new JButton("Cancel");
28+
private final JButton btSave = new JButton("Save");
29+
30+
public ConfigDlg(){
31+
initGUI();
32+
initEvent();
33+
initValue();
34+
}
35+
private void initGUI(){
36+
topPanel.setLayout(new FlowLayout(FlowLayout.LEFT));
37+
topPanel.add(lbSplitLen);
38+
topPanel.add(spSplitLen);
39+
topPanel.add(lbRange);
40+
topPanel.add(cbComment);
41+
cbComment.setSelected(true);
42+
43+
centerPanel.setLayout(new FlowLayout(FlowLayout.LEFT));
44+
centerPanel.add(lbActOnModel);
45+
centerPanel.add(chkAllTools);
46+
centerPanel.add(chkTarget);
47+
centerPanel.add(chkProxy);
48+
centerPanel.add(chkSpider);
49+
centerPanel.add(chkIntruder);
50+
centerPanel.add(chkRepeater);
51+
centerPanel.add(chkScanner);
52+
centerPanel.add(chkSequencer);
53+
centerPanel.add(chkExtender);
54+
55+
bottomPanel.setLayout(new FlowLayout(FlowLayout.CENTER));
56+
bottomPanel.add(btCancel);
57+
bottomPanel.add(btSave);
58+
59+
mainPanel.setLayout(new BorderLayout());
60+
mainPanel.add(topPanel,BorderLayout.NORTH);
61+
mainPanel.add(centerPanel,BorderLayout.CENTER);
62+
mainPanel.add(bottomPanel,BorderLayout.SOUTH);
63+
64+
this.setModal(true);
65+
this.setSize(580,140);
66+
Dimension screensize=Toolkit.getDefaultToolkit().getScreenSize();
67+
this.setBounds(screensize.width/2-this.getWidth()/2,screensize.height/2-this.getHeight()/2,this.getWidth(),this.getHeight());
68+
this.setDefaultCloseOperation(javax.swing.WindowConstants.DISPOSE_ON_CLOSE);
69+
this.add(mainPanel);
70+
}
71+
72+
private void initEvent(){
73+
chkAllTools.addActionListener(new ActionListener() {
74+
@Override
75+
public void actionPerformed(ActionEvent e) {
76+
if(chkAllTools.isSelected()){
77+
chkTarget.setSelected(true);
78+
chkProxy.setSelected(true);
79+
chkSpider.setSelected(true);
80+
chkIntruder.setSelected(true);
81+
chkRepeater.setSelected(true);
82+
chkScanner.setSelected(true);
83+
chkExtender.setSelected(true);
84+
}else{
85+
chkTarget.setSelected(false);
86+
chkProxy.setSelected(false);
87+
chkSpider.setSelected(false);
88+
chkIntruder.setSelected(false);
89+
chkRepeater.setSelected(false);
90+
chkScanner.setSelected(false);
91+
chkExtender.setSelected(false);
92+
}
93+
94+
}
95+
});
96+
97+
btCancel.addActionListener(new ActionListener() {
98+
@Override
99+
public void actionPerformed(ActionEvent e) {
100+
ConfigDlg.this.dispose();
101+
}
102+
});
103+
104+
btSave.addActionListener(new ActionListener() {
105+
@Override
106+
public void actionPerformed(ActionEvent e) {
107+
Config.splite_len = (int)spSplitLen.getValue();
108+
Config.isComment = cbComment.isSelected();
109+
Config.act_on_all_tools = chkAllTools.isSelected();
110+
Config.act_on_target = chkTarget.isSelected();
111+
Config.act_on_proxy = chkProxy.isSelected();
112+
Config.act_on_spider = chkSpider.isSelected();
113+
Config.act_on_intruder = chkIntruder.isSelected();
114+
Config.act_on_repeater = chkRepeater.isSelected();
115+
Config.act_on_scanner = chkScanner.isSelected();
116+
Config.act_on_sequencer = chkSequencer.isSelected();
117+
Config.act_on_extender = chkExtender.isSelected();
118+
ConfigDlg.this.dispose();
119+
}
120+
});
121+
122+
}
123+
124+
public void initValue(){
125+
spSplitLen.setValue(Config.splite_len);
126+
cbComment.setSelected(Config.isComment);
127+
chkAllTools.setSelected(Config.act_on_all_tools);
128+
chkTarget.setSelected(Config.act_on_target);
129+
chkProxy.setSelected(Config.act_on_proxy);
130+
chkSpider.setSelected(Config.act_on_spider);
131+
chkIntruder.setSelected(Config.act_on_intruder);
132+
chkRepeater.setSelected(Config.act_on_repeater);
133+
chkScanner.setSelected(Config.act_on_scanner);
134+
chkSequencer.setSelected(Config.act_on_sequencer);
135+
chkExtender.setSelected(Config.act_on_extender);
136+
}
137+
}

‎src/burp/IBurpExtender.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package burp;/*
2+
* @(#)burp.IBurpExtender.java
3+
*
4+
* Copyright PortSwigger Ltd. All rights reserved.
5+
*
6+
* This code may be used to extend the functionality of burp Suite Free Edition
7+
* and burp Suite Professional, provided that this usage does not violate the
8+
* license terms for those products.
9+
*/
10+
/**
11+
* All extensions must implement this interface.
12+
*
13+
* Implementations must be called BurpExtender, in the package burp, must be
14+
* declared public, and must provide a default (public, no-argument)
15+
* constructor.
16+
*/
17+
public interface IBurpExtender
18+
{
19+
/**
20+
* This method is invoked when the extension is loaded. It registers an
21+
* instance of the
22+
* <code>burp.IBurpExtenderCallbacks</code> interface, providing methods that may
23+
* be invoked by the extension to perform various actions.
24+
*
25+
* @param callbacks An
26+
* <code>burp.IBurpExtenderCallbacks</code> object.
27+
*/
28+
void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks);
29+
}

0 commit comments

Comments
 (0)