/burp-piper-custom-scripts

Custom scripts for the PIPER Burp extensions.

Primary LanguagePythonGNU General Public License v3.0GPL-3.0

code_static_analysis_and_os_compatibility_tests

Objective

Centralize and share all my custom scripts to be used with the PIPER Burp extension.

Documentation of the extension.

Runtime requirements

ℹ️ No external dependencies needed.

Python >= 3.7 needed and in PATH.

PS> python --version
Python 3.7.4

Compatibility tests

This GitHub action workfow validate that all scripts are compatible with Python 3.7, 3.8, 3.9 on Windows, Mac and Linux OS.

Embedding of this collection of scripts into the PIPER source repository

This topic is pending on the PIPER's author side. Once ready, this repository will be merged.

IDE

Visual Studio Code with Python extension provided by Microsoft is used to develop the scripts.

Project workspace file has been configured to trigger the installation of required code analysis modules and analysis profile is defined in the workspace settings area.

Structure

Each script describes its goal in its header, for which PIPER tools is targeted to be used and instruction regarding if HTTP headers must be passed as well as filter to define:

"""
PIPER script to ...
Target tool: [PIPER_TOOL]
[INSTRUCTION_IF_HTTP_HEADERS_MUST_BE_PASSED]
[FILTER_NEEDED_TO_BE_DEFINED]
"""

Overview of the scripts behavior

detect-non-standart-headers

Add a comment to the matching line in the proxy tab for every response containing non-standart HTTP headers.

detect-non-standart-headers

detect-request-to-web-api

Highlight the matching line in the proxy tab for every request that is made to a web api.

detect-request-to-web-api

extract-web-api-endpoints

Extract all API endpoints (and URL like because it is hard to really identify if a URL is an API endpoint or not from a static point view) from a JS script content obtained from a HTTP response.

extract-web-api-endpoints

extract-html-metadatas

Extract interesting information from HTML META tags from a HTTP response. Mainly used to quickly identify which products/tools was used to build the site/application.

extract-html-metadatas

detect-response-with-errors-disclosure

Detect HTTP responses containing a strack trace. Mainly used to quickly identify pages disclosing technical information via stack traces.

detect-response-with-errors-disclosure

extract-jwt-tokens

🎯 This script was created in order to avoid the need to use another extensions or the decoder to just see the content of the token.

Extract and pretty-display all JWT tokens present in an HTTP response.

extract-jwt-tokens

Configuration

⚠️ Change the script location path defined in prefix field for all custom scripts before to import the configuration.

After the import, do not forget to enable the scripts because they are all disabled by default by the import command.

For Highlighters, the color can be changed before the import by changing the color field to one constants supported by PIPER/BURP.

The file piper-config.yaml contains the complete configuration that I use for all my custom scripts.