BurpExtender开发之CORS跨域漏洞扫描器

直接看代码吧，BurpExtender.java：

package burp;

import javax.swing.*;
import javax.swing.table.AbstractTableModel;
import javax.swing.table.TableModel;
import java.awt.*;
import java.io.PrintWriter;
import java.net.URL;
import java.util.*;
import java.util.List;
import java.util.concurrent.atomic.AtomicBoolean;

public class BurpExtender extends AbstractTableModel implements IBurpExtender, IScannerCheck, ITab, IMessageEditorController, IHttpListener{
    private IBurpExtenderCallbacks callbacks;
    private IExtensionHelpers helpers;
    private JSplitPane splitPane;
    private IMessageEditor requestViewer;
    private IMessageEditor scanViewer;
    private IMessageEditor responseViewer;
    private List<VulEntry> vul_list = new ArrayList<VulEntry>();
    private IHttpRequestResponse currentlyDisplayedItem;
    public PrintWriter stdout;

    final String WebSocket_Word = "Upgrade: websocket";
    final String Evil_Domain = "http://evil.com";

    @Override
    public void registerExtenderCallbacks(final IBurpExtenderCallbacks callbacks){

        this.callbacks = callbacks;
        this.stdout = new PrintWriter(callbacks.getStdout(), true);
        this.helpers = callbacks.getHelpers();

        this.stdout.println("Author: Mi1k7ea");

        callbacks.setExtensionName("CORS CrossDomain Vul Scan");
        callbacks.registerScannerCheck(this);

        // create our UI
        SwingUtilities.invokeLater(new Runnable() {
            @Override
            public void run() {
                // main split pane
                splitPane = new JSplitPane(JSplitPane.VERTICAL_SPLIT);

                // table of vul entries
                Table vulTable = new Table(BurpExtender.this);
                JScrollPane scrollPane = new JScrollPane(vulTable);
                splitPane.setLeftComponent(scrollPane);

                // tabs with request/response viewers
                JTabbedPane tabs = new JTabbedPane();
                requestViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                scanViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                responseViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                tabs.addTab("Origin Request", requestViewer.getComponent());
                tabs.addTab("Fuzzing Request", scanViewer.getComponent());
                tabs.addTab("Response", responseViewer.getComponent());
                splitPane.setRightComponent(tabs);

                // customize our UI components
                callbacks.customizeUiComponent(splitPane);
                callbacks.customizeUiComponent(vulTable);
                callbacks.customizeUiComponent(scrollPane);
                callbacks.customizeUiComponent(tabs);

                // add the custom tab to Burp's UI
                callbacks.addSuiteTab(BurpExtender.this);

                // register ourselves as an HTTP listener
                callbacks.registerHttpListener(BurpExtender.this);
            }
        });
    }

    @Override
    public List<IScanIssue> doPassiveScan(
            IHttpRequestResponse baseRequestResponse) {
        this.stdout.println("[*]Passive Scan: " + baseRequestResponse.getHttpService());

        // 获取请求方法
        String method = this.helpers.analyzeRequest(baseRequestResponse).getMethod();

        // 提取请求参数
        List<IParameter> baseParams = this.helpers.analyzeRequest(baseRequestResponse.getRequest()).getParameters();
        StringBuilder sb = new StringBuilder();
        baseParams.forEach(p -> {
            if (sb.length() > 0) {
                sb.append("&" + p.getName() + "=" + p.getValue());
            } else {
                sb.append(p.getName() + "=" + p.getValue());
            }
        });
        String baseRequestParams = sb.toString();

        scanCORS(baseRequestResponse, method, baseRequestParams);

        return null;
    }

    @Override
    public List<IScanIssue> doActiveScan(
            IHttpRequestResponse baseRequestResponse,
            IScannerInsertionPoint insertionPoint) {
        // TODO here
        return null;
    }

    @Override
    public int consolidateDuplicateIssues(IScanIssue existingIssue,
                                          IScanIssue newIssue) {
        // TODO here
        return 0;
    }

    @Override
    public String getTabCaption() {
        return "CORS跨域漏洞扫描器";
    }

    @Override
    public Component getUiComponent() {
        return this.splitPane;
    }

    @Override
    public IHttpService getHttpService() {
        return this.currentlyDisplayedItem.getHttpService();
    }

    @Override
    public byte[] getRequest() {
        return this.currentlyDisplayedItem.getRequest();
    }

    @Override
    public byte[] getResponse() {
        return this.currentlyDisplayedItem.getResponse();
    }

    @Override
    public int getRowCount() {
        return vul_list.size();
    }

    @Override
    public int getColumnCount() {
        return 2;
    }

    @Override
    public String getColumnName(int columnIndex) {
        switch (columnIndex) {
            case 0:
                return "Name";
            case 1:
                return "URL";
            default:
                return "";
        }
    }

    @Override
    public Class<?> getColumnClass(int columnIndex) {
        return String.class;
    }

    @Override
    public Object getValueAt(int rowIndex, int columnIndex) {
        VulEntry vulEntry = vul_list.get(rowIndex);

        switch (columnIndex) {
            case 0:
                return vulEntry.vul_name;
            case 1:
                return vulEntry.url.toString();
            default:
                return "";
        }
    }

    @Override
    public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {

    }

    // extend JTable to handle cell selection
    private class Table extends JTable {
        public Table(TableModel tableModel) {
            super(tableModel);
        }

        @Override
        public void changeSelection(int row, int col, boolean toggle, boolean extend) {
            VulEntry vulEntry = vul_list.get(row);
            requestViewer.setMessage(vulEntry.baseRequestResponse.getRequest(), true);
            scanViewer.setMessage(vulEntry.fuzzingRequestResponse.getRequest(), true);
            responseViewer.setMessage(vulEntry.fuzzingRequestResponse.getResponse(), false);
            currentlyDisplayedItem = vulEntry.fuzzingRequestResponse;

            super.changeSelection(row, col, toggle, extend);
        }
    }


    private static class VulEntry {
        String vul_name;
        IHttpRequestResponsePersisted baseRequestResponse;
        IHttpRequestResponsePersisted fuzzingRequestResponse;
        URL url;

        public VulEntry(String vul_name, IHttpRequestResponsePersisted baseRequestResponse, IHttpRequestResponsePersisted fuzzingRequestResponse, URL url) {
            this.vul_name = vul_name;
            this.baseRequestResponse = baseRequestResponse;
            this.fuzzingRequestResponse = fuzzingRequestResponse;
            this.url = url;
        }
    }


    void scanCORS(IHttpRequestResponse baseRequestResponse, String method, String baseRequestParams) {
        List<String> response_headers = this.helpers.analyzeResponse(baseRequestResponse.getResponse()).getHeaders();
        AtomicBoolean acao = new AtomicBoolean(false);
        AtomicBoolean acac = new AtomicBoolean(false);

        response_headers.forEach(header -> {
            if (header.toLowerCase().startsWith("access-control-allow-origin: ")) {
                acao.set(true);
            }
            if (header.toLowerCase().equals("access-control-allow-credentials: true")) {
                acac.set(true);
            }
        });

        // 这里添加了ACAC为true的条件，也可以去掉，看实际情况
        if (acao.get() && acac.get()) {
            // 替换Origin头为恶意域名
            List<String> fuzzing_headers = this.helpers.analyzeRequest(baseRequestResponse).getHeaders();
            fuzzing_headers.forEach(header -> {
                if (header.toLowerCase().startsWith("origin:")) {
                    Collections.replaceAll(fuzzing_headers, header, "Origin: " + this.Evil_Domain);
                }
            });

            byte[] baseBody = null;

            if (method.equals("POST")) {
                baseBody = this.helpers.stringToBytes(baseRequestParams);
            }

            byte[] fuzzingBody = this.helpers.buildHttpMessage(fuzzing_headers, baseBody);
            IHttpRequestResponse fuzzingRequestResponse = this.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), fuzzingBody);


            if (this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getHeaders().contains("Access-Control-Allow-Origin: " + this.Evil_Domain)
                    || this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getHeaders().contains("Access-Control-Allow-Origin: *")) {
                this.stdout.println("[!]存在CORS跨域漏洞!");

                int row = this.vul_list.size();
                this.vul_list.add(
                        new VulEntry(
                                "CORS跨域漏洞",
                                this.callbacks.saveBuffersToTempFiles(baseRequestResponse),
                                this.callbacks.saveBuffersToTempFiles(fuzzingRequestResponse),
                                this.helpers.analyzeRequest(fuzzingRequestResponse).getUrl()
                        )
                );
                fireTableRowsInserted(row, row);
            }

        }
    }

}

效果：

小问题：有些接口请求没有带Origin头但是可能存在CORS跨域漏洞，跨域针对这种情况自行判断响应存在ACAC后重新构造的请求报文中添加Origin头来测试。