A plugin that allows you execute python and get return to BurpSuite.
During Android APP pentesting, I found it very often that the traffic is encrypted and/or signed, it would be great to have a plugin so we can write python to enc/dec/sign.
And, sometimes, you may just want some customized function to modify part of the traffic, all you need is just Burpy Main
.
If you wanna take advantage of the intruder with payloads need to be encrypted, you need to Enable Processor
, and write your own payload processor function.
m0nst3r(Song Xinlei)@ @CFCA
- change to use class instead of pure function, so that we can init webdriver+selenium when loading without init it per call
- modified plugin to enable 4 function calls: main/enc/dec/sign
- add payload processor
check the examples for scripts
- install PyRO, version 4 is used.
- configure python and pyro settings
- configure the python file you wanna run
- use
spawn
to test the result - use
Burpy Main
/Burpy Enc
/Burpy Dec
/Burpy Sign
context memu to invoke your script - write own payload processor, especially usefull with enc/dec
Just write your own logic to modify the header/body as your need, and return the header/body, just that simple!
Note: if you need to handle response data, e.g decrypt response, you need to check whether the header[0]
is RESPONSE
or not.
If the data burpsuite sent to python comes from response
, the header will be header[0] == 'RESPONSE'
class Burpy:
'''
header is list, append as your need
body is string, modify as your need
'''
def main(self, header, body):
return header, body
def encrypt(self, header, body):
header.append("Enc: AAA")
return header, body
def decrypt(self, header, body):
'''
You may want to add logic if the response differ from the request, for example in the request, the encrypted data is followed after "data=", but in the response, the whole response body is encrypted data, without "data="
'''
# header = magic(header)
# body = magic(body)
return header, body
def sign(self, header, body):
header.append("Sign: AAA")
return header, body
def processor(self, payload):
'''
payload processor function
'''
return payload+"123"
the great Brida
- Good ideas and contributions are welcomed.