[Feature] Add context menu option to only scan for log4j about burp-log4shell

[dnet]

Just show me a single one that provides such an option that initiates an active scan on the current request focusing on the single vulnerability class targeted by the extension.

[dnet]

I'm sorry but given the current set of APIs available for Extender plugins, that's just plain impossible. Your code snippets hide the problematic part as ... in self._extender.doActiveScan(...); as IScannerCheck.doActivescan expects (and in most cases, including this plugin as well, uses) a second parameter with an insertion point (an object that implements IScannerInsertionPoint).

So first of all, doActiveScan is called not just for a single scan, but once for each insertion point. And there's just no API provided to actually get all those insertion points by an Extender plugin. Try searching for IScannerInsertionPoint in the Burp Extender API documentation and you'll find that your average plugin can only interact with such objects in three cases.

• You get one if you're a scanner check, just as I described above. This is how Active scan works, they call you, never the other way around.
• You provide such insertion points to the active scanner and it calls all the other scanner checks with those provided by you included in the set. Again, the data flow is unidirectional, you don't get to ask Burp to collect and provide those insertion points for you.
• You create one manually with makeScannerInsertionPoint, however, you have to figure out how to parse its location and what encoding to use. Even the official API documentation states

It can be used to quickly create a simple insertion point based on a fixed payload location within a base request.

So AFAIK what you ask for is impossible, or to put it in another way, making it possible is just not worth it. You'd have to implement half of the built-in active scanner to implement the code that's already there, it's just inaccessible to your average extension. Another, contrived way would be doing such a version where the user has to select the part manually (like in Intruder) and specify encoding explicitly.

Please only reopen this if you have information that disproves any of the above. If you'd like to do the reimplementation part, feel free to submit a PR.

[Regala]

I have my doubts that all extensions that provide a context menu to initiate an active scan on the current request have done something impossible but, eh. Cheers

…

On Wed, Dec 15, 2021, 15:54 András Veres-Szentkirályi < ***@***.***> wrote: Closed #9 <#9>. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#9 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKRBL4V37QQSREGHXZZIVTURC23XANCNFSM5KDEXUHA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.