gh0stkey / caa

CaA - Collector and Analyzer, Insight into information, exploring with intelligence in a thousand ways.

About Me

HACK THE WORLD - TO DO IT.

• Name: [ EvilChen ]
• Job: [ Security Researcher ]
• Team: [ OverSpace Security Team ] - [ Free, Share, Open. ]
• Favorite: [ Hacker, Code, Music ]
• Blog: [ https://gh0st.cn/ ] - [ Share thoughts, ideas, and learnings in the field of security. ]

caa's Issues

运行后没有任何数据

使用环境

CaA版本：Beta 0.9
BurpSuite版本：v2024.4.5
JDK版本：BurpSuite自带
操作系统版本：win10

问题详情

问题描述：
send to fuzzer后，在taskboard页面只能搜索到task name，下方无数据。

出现的场景：
开始fuzz

解决建议

无。

已解决

已解决

该插件是否支持低版本java

师傅您好，该插件是否支持低版本java，java版本java8

加载插件时出错且burp卡住，错误如下，不止是否是因为utilities().urlUtils()处理含\u00xx Unicode编码的字符出错

查询结果能否支持csv导出功能

你好，非常感谢你编写这款实用的工具，我有个建议，能不能支持查询结果导出，能导出txt、csv之类的简单格式就行，还有查询时能否支持主域名，比如“sp2.baidu.com”只需要输入“baidu.com”即可查到。

v0.5版本连接数据库后成功创建表结构，但无数据

环境：
intel macOS 13.3.1 (22E261)
Burp Suite Professional v2022.12.5
CaA-0.5-J8.jar
MYSQL Server version: 8.0.32 Homebrew

(BP使用的是高版本JDK，但是我在Bp的Extensions-Options-Java Environment配置了JAVA1.8.0_151环境，我其他插件如HaE(2.4.6)、xia SQL V3.3均使用的是J8版本。)

情况：
Connect后无异常报错，数据库成功创建表结构。

请问和创建数据库选择的这些有关系吗？

遇到收集不到的目录

这种#号的似乎压根不会加载到burp

功能建议与bug

burp：2024.3.1.3
JDK：21

参数匹配处出现异常（已筛选域名，图中域名为防泄露已删除），前半部分收集到正常参数，后半部分收集的就是垃圾字符：

另外插件还有报错：

	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:775)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:720)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:714)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:98)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:747)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:744)
	at burp.Zwr6.dispatchEvent(Unknown Source)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)
java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: "ï¿"
	at java.base/java.net.URLDecoder.decode(URLDecoder.java:243)
	at burp.Zevb.decode(Unknown Source)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at burp.Zrp.invoke(Unknown Source)
	at jdk.proxy2/jdk.proxy2.$Proxy124.decode(Unknown Source)
	at burp.Zd9q.decode(Unknown Source)
	at caa.instances.Collector.decodeParameter(Collector.java:268)
	at caa.instances.Collector.passiveAudit(Collector.java:114)
	at caa.instances.editor.ResponseEditor$Editor.isEnabledFor(ResponseEditor.java:80)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at burp.Zrp.invoke(Unknown Source)
	at jdk.proxy5/jdk.proxy5.$Proxy103.isEnabledFor(Unknown Source)
	at burp.Zhz5.Zy(Unknown Source)
	at burp.Zh2r.Zi(Unknown Source)
	at burp.Zeq_.lambda$updateVisiblePanes$1(Unknown Source)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1708)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at burp.Zde7.ZC(Unknown Source)
	at burp.Zde7.ZR(Unknown Source)
	at burp.Zeq_.Zt(Unknown Source)
	at burp.Zeq_.Zs(Unknown Source)
	at burp.Zd8j.Zw(Unknown Source)
	at burp.Zd8j.lambda$new$2(Unknown Source)
	at java.desktop/java.awt.Component.processHierarchyEvent(Component.java:6788)
	at java.desktop/java.awt.Component.processEvent(Component.java:6407)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.Component.createHierarchyEvents(Component.java:5634)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1474)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Component.show(Component.java:1691)
	at java.desktop/java.awt.Component.show(Component.java:1728)
	at java.desktop/java.awt.Component.setVisible(Component.java:1675)
	at java.desktop/javax.swing.JComponent.setVisible(JComponent.java:2729)
	at java.desktop/javax.swing.JTabbedPane.fireStateChanged(JTabbedPane.java:424)
	at java.desktop/javax.swing.JTabbedPane$ModelListener.stateChanged(JTabbedPane.java:297)
	at java.desktop/javax.swing.DefaultSingleSelectionModel.fireStateChanged(DefaultSingleSelectionModel.java:148)
	at java.desktop/javax.swing.DefaultSingleSelectionModel.setSelectedIndex(DefaultSingleSelectionModel.java:79)
	at java.desktop/javax.swing.JTabbedPane.setSelectedIndexImpl(JTabbedPane.java:650)
	at java.desktop/javax.swing.JTabbedPane.setSelectedIndex(JTabbedPane.java:625)
	at burp.Zcem.setSelectedIndex(Unknown Source)
	at java.desktop/javax.swing.plaf.basic.BasicTabbedPaneUI$Handler.mousePressed(BasicTabbedPaneUI.java:4140)
	at com.formdev.flatlaf.ui.FlatTabbedPaneUI$Handler.mousePressed(FlatTabbedPaneUI.java:2697)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.Component.processMouseEvent(Component.java:6618)
	at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3398)
	at java.desktop/java.awt.Component.processEvent(Component.java:6386)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at burp.Zwpj.ZU(Unknown Source)
	at burp.Zmc_.mousePressed(Unknown Source)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:288)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.Component.processMouseEvent(Component.java:6618)
	at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3398)
	at java.desktop/java.awt.Component.processEvent(Component.java:6386)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4948)
	at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4572)
	at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4516)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2310)
	at java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2780)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:775)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:720)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:714)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:98)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:747)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:744)
	at burp.Zwr6.dispatchEvent(Unknown Source)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

最后有一个功能建议，可否添加一个右键删除功能：

多谢老哥

【功能优化】师傅，路径功能能否优化为完整路径

使用环境

CaA版本：0.9
BurpSuite版本：
JDK版本：BurpSuite自带
操作系统版本：

问题详情

问题描述：
师傅，路径功能能否优化为完整路径，提取到的路径都是单级路径/cc这样，能否优化为完整路径/aa/bb/cc这样

出现的场景：

解决建议

无。

[BUG] 低版本安装报错

师傅什么时候可适配支持低版本bp❤

加载报错[BUG]

使用环境

CaA版本：0.9
BurpSuite版本：22.3.7
JDK版本：BurpSuite自带
操作系统版本：windows11

问题详情

问题描述：
安装插件时报错
java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:433)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:586)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:519)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:466)
at burp.cvr.a(Unknown Source)
at burp.cvr.(Unknown Source)
at burp.cru.a(Unknown Source)
at burp.av0.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
at java.base/java.lang.Thread.run(Thread.java:831)

出现的场景：

解决建议

无。

安装插件出现报错

是需要单独配置数据库么

建议使用doPassiveScan

因为用了云数据库，所以出了点儿问题Orz。processHttpMessage每次处理请求的时候要🔗数据库，就导致处理时间变长，然后响应时间就变慢了，略微影响了使用😭，这种情况下是不是doPassiveScan兼容性要高点儿👀

[ADVISE]师傅能 做一个可以控制不让CaA进行 停止抓取，内存占用会比较高

使用环境

CaA版本：
BurpSuite版本：
JDK版本：BurpSuite自带
操作系统版本：

问题详情

问题描述：

出现的场景：

解决建议

无。

加载报错

使用环境

CaA版本：0.8/0.9
BurpSuite版本：BurpSuite V2024.3.1
JDK版本：java8
操作系统版本：windows10

问题详情

问题描述：
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.

出现的场景：

解决建议

无。

安装报错

java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:435)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:468)
at burp.e7u.a(Unknown Source)
at burp.e7u.(Unknown Source)
at burp.a_p.a(Unknown Source)
at burp.fpe.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
at java.base/java.lang.Thread.run(Thread.java:832)

该插件不支持22年的burp吗

似乎并不支持旧版本burp，这个问题能否解决，因为burp有其他插件，在较新版本的bp并不兼容

[BUG] caA的Tab中看不到settings按钮，无法进行配置

使用环境

CaA版本：
CaA-Beta-0.9

BurpSuite版本：
burpsuite_pro_v2024.3.1.4

JDK版本：jdk-22.0.1

操作系统版本：win10

问题详情

问题描述：
caA成功加载到burp，无报错，但是Tab中看不到settings按钮

出现的场景：
上述环境中，CaA-Beta-0.9与0.8均有此现象，且尝试调整过burp字体大小设置，发现并没有效果

解决建议

无。

[BUG]

老哥，请问这个0.9版本适用的最低burpsuite版本是多少呀？

burp导入后数据库也连接成功，挖洞时一直未存入数据库。整个数据库表是空的

burp导入后数据库也连接成功，挖洞时一直未存入数据库。整个数据库表是空的

Why don't you have a jar file?

Why don't you have a jar file?
How to download and use it?

建议添加占位符

使用环境

CaA版本：/
BurpSuite版本：/
JDK版本：BurpSuite自带
操作系统版本：/

建议

添加占位符功能可以指定参数名和参数值在json格式里进行fuzz