Getting started with Burp Suite extension_Getting started with Burp Suite extension.png

EducativeDockerBurpV2.tar.gz

BurpSuiteCommunityBuildTheJarV4

This course is for folks who are new to security, are experts already, or are just curious. We will learn how to build Burp Suite extension plugins with a focus on development using IntelliJ & Java.

You will be able to build Burp Suite Extension Plugins from scratch with live development and testing in Java by the end of the course. These projects will be useful learning experiences for both web application security specialists and developers. This course assumes a rudimentary understanding of Burp Suite as well as basic object-oriented programming experience.

Burp Suite Extension Development


# Understand public interface IHTTPListener

`IHTTPListener` is an interface that extensions can implement before calling  `IBurpExtenderCallbacks.registerHttpListener()` to register an HTTP listener. The listener will be notified of requests and responses made by any Burp tool. Extensions can perform custom analysis or modifications of these messages by registering an HTTP listener.


# Implement the IHTTPListener Interface
Let's create a class that will implement the `IHTTPListener` interface. The class will do the following:

* Listen for events from the Burp Suite "Proxy" tab.
* Be notified of requests and responses from Burp Proxy.
* Log all the requests in the "Alerts" tab.

 In this interface, we would need to implement the `processHttpMessage` method.
```java
/*
    LogProxyRequests.java
*/

package burp;

public class LogProxyRequests implements IHttpListener{

    private IBurpExtenderCallbacks iBurpExtenderCallbacks;
    private IExtensionHelpers iExtensionHelpers;

    public LogProxyRequests(IBurpExtenderCallbacks callbacks){
        /*
            For issuing an alert to Alter tab.
         */
        iBurpExtenderCallbacks = callbacks;

        /*
            For parsing requests.
         */
        iExtensionHelpers = callbacks.getHelpers();
    }

    @Override public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {
        IRequestInfo requestInfo = null;

        /*
            Only listen for events from Burp Suite proxy && Only listen for requests.
         */
        if(toolFlag == IBurpExtenderCallbacks.TOOL_PROXY && messageIsRequest == true)
            requestInfo = iExtensionHelpers.analyzeRequest(messageInfo);
            String domainName = requestInfo.getUrl().getHost();

            /*
                Log the domain name to the Alerts tab.
             */
            iBurpExtenderCallbacks.issueAlert("Proxy: " + domainName);
    }
}
```

# Register the implemented class 

Let's register the implemented class in our `BurpExtender.java` class file.

```java
/*
    BurpExtender.java
*/

package burp;

public class BurpExtender implements IBurpExtender{
    @Override public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {
        callbacks.setExtensionName("Proxy Request Logger");
        callbacks.issueAlert("Extension loaded");

        /*
            Register our LogProxyRequest instance to burp suite proxy.
         */
        callbacks.registerHttpListener(new LogProxyRequests(callbacks));
    }
}
```
Now, we can build the JAR file and load it in Burp Suite. If everything goes well, we will see domain names logged in the "Alerts" tab, as shown below.


This lesson will go over how to implement, register, build, and run interfaces. We will also explore how a class implementing the interface listens for events from the "Proxy" tab and logs all requests and responses coming from Burp Proxy.

__default

Listening For Events From Burp's Proxy Tab

Understand public interface IHTTPListener