就是把流量导到其他的扫描器上面
 
1
#!/usr/bin/env python
2
# -*- coding: utf-8 -*-
3
# @Time    : 2019/11/22 17:51
4
# @Author  : xiaodong
5
# @github  : https://github.com/dongfangyuxiao/
6
# @Site    : #
7
# @File    : burp_xray.py
8
# @Software: PyCharm
9
#脚本就是把流量，纯净的，转发一份给xray或者appscan
10
#!/usr/bin/env python
11
# -*- coding: utf-8 -*-
12
# @Time    : 2019/10/25 15:25
13
# @Author  : xiaodong
14
# @github  : https://github.com/dongfangyuxiao/
15
# @Site    : #
16
# @File    : Burp_Dir.py
17
# @Software: PyCharm
18
import threading
19
import re
20
from burp import IBurpExtender
21
from burp import IHttpListener
22
from burp import IHttpRequestResponse
23
from burp import IResponseInfo
24
from burp import IRequestInfo
25
from burp import IHttpService
26
from burp import IScannerCheck
27
from burp import IScannerInsertionPointProvider
28
from burp import IParameter
29
from burp import IScanIssue
30
from java.net import URL
31
from urlparse import urlparse  #我自己的环境是py3，但bp只支持py2，这里没有导入没关系的
32
import sys
33
sys.path.append('C:/Python27/Lib/site-packages')
34
import requests
35
class BurpExtender(IBurpExtender, IScannerCheck):
36
37
    def registerExtenderCallbacks(self, callbacks):
38
        self._callbacks = callbacks
39
        self._helpers = callbacks.getHelpers()
40
        self._callbacks.registerScannerCheck(self)  # 注册扫描插件
41
        self._callbacks.setExtensionName("DIR")  # 定义插件的名称
42
        print("for xray scan")
43
        self.lfiD = []
44
        self.proxies = {
45
            "http":"http://127.0.0.1:9090",
46
            "https":"https://127.0.0.1:9090"
47
        }
48
    # 以上都是标准化程序
49
50
    def doPassiveScan(self, baseRequestResponse):
51
        Request = baseRequestResponse.getRequest()
52
        Response = baseRequestResponse.getResponse()
53
        analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters = self.get_request_info(Request)
54
        ResHeaders, ResBodys, ResStatusCode, resLength = self.get_response_info(Response)
55
        httpService = baseRequestResponse.getHttpService()
56
        host, port, protocol, ishttps, = self.get_server_info(httpService)
57
58
        heaers = {
59
        }
60
61
        targetHost = ['saicmaxus', 'saicmotor', 'maxuscloud', 'rv2go', '224', '226', '129', '130', '91', 'sxc', 'bihuo',
62
                     '100', 'bihuoedu', 'islefoundation']
63
        if (host.split('.')[-3] in targetHost) or (
64
                host.split('.')[-2] in targetHost):  # 多级或单级或类似baidu.net.cn的形势取主域名字段，比对是否在目标列表中
65
            newReqUrl = self.get_request_url(protocol, reqHeaders)
66
67
68
            newHeaders = reqHeaders[1:]
69
70
            for header in newHeaders:
71
                heaers[header.split(':')[0]] = header.split(':')[1].strip()
72
73
            if reqMethod == "GET":
74
                response = requests.get(newReqUrl, headers=heaers, proxies=self.proxies,verify=False,allow_redirects=True)
75
            elif reqMethod == "POST":
76
                response = requests.post(newReqUrl, headers=heaers, data=reqBodys,proxies=self.proxies,verify=False,allow_redirects=True)
77
            elif reqMethod == "PUT":
78
                response = requests.put(newReqUrl, headers=heaers, data=reqBodys, proxies=self.proxies, verify=False,
79
                                         allow_redirects=True)
80
            elif reqMethod == "DELETE":
81
                response = requests.delete(newReqUrl, headers=heaers, data=reqBodys, proxies=self.proxies, verify=False,
82
                                         allow_redirects=True)
83
            else :
84
85
                response = requests.options(newReqUrl, headers=heaers, data=reqBodys, proxies=self.proxies, verify=False,
86
                                           allow_redirects=True)
87
88
89
90
    def consolidateDuplicateIssues(self, existingIssue, newIssue):
91
92
        return 0
93
94
    def doActiveScan(self, baseRequestResponse, insertionPoint):
95
        # report the issue
96
        return None
97
98
99
100
101
    # 获取响应的一些信息：响应头，响应内容，响应状态码
102
103
104
        # 获取服务端的信息，主机地址，端口，协议
105
106
    def get_server_info(self, httpService):
107
        host = httpService.getHost()
108
        port = httpService.getPort()
109
        protocol = httpService.getProtocol()
110
        ishttps = False
111
        if protocol == 'https':
112
            ishttps = True
113
        return host, port, protocol, ishttps
114
115
        # 获取请求的参数名、参数值、参数类型（get、post、cookie->用来构造参数时使用）
116
117
    def get_response_info(self, response):
118
        analyzedResponse = self._helpers.analyzeResponse(
119
            response)  # analyzeResponse方法可用于分析HTTP响应，并获取有关它的各种关键详细信息。返回：IResponseInfo可以查询的对象以获取有关响应的详细信息。
120
        resHeaders = analyzedResponse.getHeaders()  # getHeaders方法用于获取响应中包含的HTTP标头。返回：响应中包含的HTTP标头。
121
        resBodys = response[
122
                   analyzedResponse.getBodyOffset():].tostring()  # getBodyOffset方法用于获取消息正文开始的响应中的偏移量。返回：消息正文开始的响应中的偏移量。response[analyzedResponse.getBodyOffset():]获取正文内容
123
        resStatusCode = analyzedResponse.getStatusCode()  # getStatusCode获取响应中包含的HTTP状态代码。返回：响应中包含的HTTP状态代码。
124
        for header in resHeaders:
125
            if 'Content-Length' in header:
126
                resLength = int(header.split(':')[1].strip())  # 我在这里增加了一个返回包长度检测
127
            else:
128
                resLength = int(0)
129
        return resHeaders, resBodys, resStatusCode, resLength
130
131
    def get_parameter_Name_Value_Type(self, parameter):
132
        parameterName = parameter.getName()
133
        parameterValue = parameter.getValue()
134
        parameterType = parameter.getType()
135
        return parameterName, parameterValue, parameterType
136
137
        # 获取请求的url
138
139
    def get_request_url(self, protocol, reqHeaders):
140
        link = reqHeaders[0].split(' ')[1]
141
        host = reqHeaders[1].split(' ')[1]
142
        if 'http' in link:
143
            return link
144
        else:
145
            return protocol + '://' + host + link
146
147
    # 保存结果
148
    def save(self, content):
149
        print(content)
150
        f = open('burp_lfi.txt', 'at')
151
        f.writelines(content + '\n\n')
152
        f.close()
153
154
    def saveUrl(self, content):
155
        print(content)
156
        f = open('burp_url.txt', 'at')
157
        f.writelines(content + '\n\n')
158
        f.close()
159
160
    def get_request_info(self, request):
161
        analyzedRequest = self._helpers.analyzeRequest(
162
            request)  # analyzeRequest用于分析HTTP请求，并获取有关它的各种关键详细信息。生成的IRequestInfo对象
163
        reqHeaders = analyzedRequest.getHeaders()  # 用于获取请求中包含的HTTP头。返回：请求中包含的HTTP标头。
164
        reqBodys = request[analyzedRequest.getBodyOffset():].tostring()  # 获取消息正文开始的请求中的偏移量。返回：消息正文开始的请求中的偏移量。
165
        reqMethod = analyzedRequest.getMethod()  # 获取请求方法
166
        reqParameters = analyzedRequest.getParameters()
167
        return analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters
168