1.6 KiB
Burp Value Autoupdater
Description
Simple Burp Suite plugin which stores values from incoming requests.
The values to watch for can be defined using regex or simply header names.
Values which have been stored can be used in outgoing requests using $placeholders$.
Usage
As an example, let's say we want to keep track of a CSRF token, sent to us as the cookie csrf.
We set up a regex to watch for the value like so:
We receive a response to a request (via any enabled tool) that contains a new CSRF value:
HTTP/1.1 200 OK
Set-Cookie: csrf=the_csrf_token
The stored value gets updated with the token we received in the response:
We can then use the $placeholder$ in a request, which will automatically fill in the stored value:
GET / HTTP/1.1
Host: nns.ee
Cookie: csrf=$csrf$; session=123
Regex matching (and placing values) works in any part of the request, not just the headers.
The regex matcher uses the re2 syntax.
Installation
Currently, no .jar files are provided. Once I feel this project is polished enough to publish releases for, I will probably upload this to the Burp App store.
You can, however, build the .jar yourself if you so desire.
Once you have a .jar, in Burp Suite, go to Extender -> Add and load the file as a Java extension.
Building
Building is done via Gradle. To build a .jar with all dependencies included, do:
./gradlew shadowJar
The .jar file can then be found in build/libs/ (look for the version tagged -all).