Question

我遇到Burpsuite API的问题，我找不到合适的功能来打印出已编辑请求的响应。我正在使用python为burpsuite开发一个新的插件。 myscript只是接受来自代理的请求，然后编辑标题并再次发送。

来自burp import IBurpExtender 来自burp import IHttpListener

import re，urllib2

类BurpExtender（IBurpExtender，IHttpListener）：

def registerExtenderCallbacks(self, callbacks):
    self._callbacks = callbacks
    self._helpers = callbacks.getHelpers()
    callbacks.setExtensionName("Burp Plugin Python Demo")
    callbacks.registerHttpListener(self)
    return

def processHttpMessage(self, toolFlag, messageIsRequest, currentRequest):
    # only process requests
    if messageIsRequest:

        requestInfo = self._helpers.analyzeRequest(currentRequest)
        #timestamp = datetime.now()        
        #print "Intercepting message at:", timestamp.isoformat()

        headers = requestInfo.getHeaders()
        #print url
        if(requestInfo.getMethod() == "GET"):
            print "GET"
            print requestInfo.getUrl()
            response = urllib2.urlopen(requestInfo.getUrl())
            print response
        elif(requestInfo.getMethod() == "POST"):
            print "POST"
            print requestInfo.getUrl()
        #for header in headers:
            #print header

        bodyBytes = currentRequest.getRequest()[requestInfo.getBodyOffset():]
        bodyStr = self._helpers.bytesToString(bodyBytes)
        bodyStr = re.sub(r'=(\w+)','=<xss>',bodyStr)
        newMsgBody = bodyStr
        newMessage = self._helpers.buildHttpMessage(headers, newMsgBody)
        print "Sending modified message:"
        print "----------------------------------------------"
        print self._helpers.bytesToString(newMessage)
        print "----------------------------------------------\n\n"
        currentRequest.setRequest(newMessage)
    return

Answer 1

您需要打印回复，但是如果messageIsRequest为false，您就不会做任何事情。当messageIsRequest为false时，表示currentRequest是一个响应，您可以像对请求一样打印出响应。我是这样用Java做的：

def processHttpMessage(self, toolFlag, messageIsRequest, httpRequestResponse):
    if messageIsRequest:
        ....
    else
        HTTPMessage = httpRequestResponse.getResponse()
        print HTTPMessage

甚至还有一种方法可以让您在使用代理时将请求和响应绑定在一起。它可以在IInterceptedProxyMessage中找到：

/**
 * This method retrieves a unique reference number for this
 * request/response.
 *
 * @return An identifier that is unique to a single request/response pair.
 * Extensions can use this to correlate details of requests and responses
 * and perform processing on the response message accordingly.
 */
int getMessageReference();

我认为HTTPListeners不支持它。

我正在用Java编写扩展，并试图为这个anwser翻译成Python。我还没有测试过这段代码，因为翻译可能会引入一些错误。

BurpSuite API - 从编辑的请求中获取响应

1 个答案: