phefley / burp-javascript-security-extension

A Burp Suite extension which performs checks for cross-domain scripting against the DOM, subresource integrity checks, and evaluates JavaScript resources against threat intelligence data.

• 👋 Hi, I’m @phefley (@peterhefley on Twitter)
• 👀 I’m interested in information security, penetration testing, application security, red teaming, and cryptography
• 🌱 I’m currently learning GoLang and cloud security
• 💞️ I’m looking to collaborate on penetration testing automation and collaboration

burp-javascript-security-extension's Issues

Mac Chromedriver location

Mac OSX 10.14.5 after installing chromedriver with brew.

java.lang.IllegalStateException: The driver executable does not exist: /usr/lib/chromium-browser/chromedriver

$ which chromedriver
/usr/local/bin/chromedriver

Because of SIP I can't just link to to /usr/lib without disabling SIP.

I see references to a UI component to select a chromedriver, but I don't see any way to activate this screen.

IoCs Not Saved

The IoCs not saved in the project settings. They must be reloaded if burp is restarted/project opened.

BurpSuite v2.0.23beta
OS X 10.14.5

Change IoC import format to an industry standard

Consider OpenIOC

Chromedriver location

Ensure that Chrome/Chromium is installed in a standard location.

java.lang.IllegalStateException: The driver executable does not exist: /usr/lib/chromium-browser/chromedriver
	at com.google.common.base.Preconditions.checkState(Preconditions.java:585)
	at org.openqa.selenium.remote.service.DriverService.checkExecutable(DriverService.java:137)
	at org.openqa.selenium.remote.service.DriverService$Builder.usingDriverExecutable(DriverService.java:272)
	at org.focalpoint.isns.burp.srichecks.DriverServiceManager.startDriverService(DriverServiceManager.java:54)
	at org.focalpoint.isns.burp.srichecks.DriverServiceManager.<init>(DriverServiceManager.java:45)
	at burp.BurpExtender.<init>(BurpExtender.java:58)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at burp.ete.a(Unknown Source)
	at burp.ete.<init>(Unknown Source)
	at burp.dgg.a(Unknown Source)
	at burp.ld.lambda$panelLoaded$0(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:835)

The login looks for chromedriver in /usr/lib/chromium-browser/chromedriver as if it was the standard way. On ArchLinux and others distro it is located at /usr/lib/chromium.

Maybe you should look for several standard path before raising an error.

chromedriver location not saved

The chromedriver location is not saved in the project settings. It must be re-selected every time.

BurpSuite v2.0.23beta
OS X 10.14.5