BurpExtender开发之跨站点WebSocket劫持漏洞扫描器

直接看代码吧，BurpExtender.java：

package burp;

import javax.swing.*;
import javax.swing.table.AbstractTableModel;
import javax.swing.table.TableModel;
import java.awt.*;
import java.io.PrintWriter;
import java.net.URL;
import java.util.*;
import java.util.List;
import java.util.concurrent.atomic.AtomicBoolean;

public class BurpExtender extends AbstractTableModel implements IBurpExtender, IScannerCheck, ITab, IMessageEditorController, IHttpListener{
    private IBurpExtenderCallbacks callbacks;
    private IExtensionHelpers helpers;
    private JSplitPane splitPane;
    private IMessageEditor requestViewer;
    private IMessageEditor scanViewer;
    private IMessageEditor responseViewer;
    private List<VulEntry> vul_list = new ArrayList<VulEntry>();
    private IHttpRequestResponse currentlyDisplayedItem;
    public PrintWriter stdout;

    final String WebSocket_Word = "Upgrade: websocket";
    final String Evil_Domain = "http://evil.com";

    @Override
    public void registerExtenderCallbacks(final IBurpExtenderCallbacks callbacks){

        this.callbacks = callbacks;
        this.stdout = new PrintWriter(callbacks.getStdout(), true);
        this.helpers = callbacks.getHelpers();

        this.stdout.println("Author: Mi1k7ea");

        callbacks.setExtensionName("CrossSite WebSocket Hijacking Vul Scan");
        callbacks.registerScannerCheck(this);

        // create our UI
        SwingUtilities.invokeLater(new Runnable() {
            @Override
            public void run() {
                // main split pane
                splitPane = new JSplitPane(JSplitPane.VERTICAL_SPLIT);

                // table of vul entries
                Table vulTable = new Table(BurpExtender.this);
                JScrollPane scrollPane = new JScrollPane(vulTable);
                splitPane.setLeftComponent(scrollPane);

                // tabs with request/response viewers
                JTabbedPane tabs = new JTabbedPane();
                requestViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                scanViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                responseViewer = callbacks.createMessageEditor(BurpExtender.this, false);
                tabs.addTab("Origin Request", requestViewer.getComponent());
                tabs.addTab("Fuzzing Request", scanViewer.getComponent());
                tabs.addTab("Response", responseViewer.getComponent());
                splitPane.setRightComponent(tabs);

                // customize our UI components
                callbacks.customizeUiComponent(splitPane);
                callbacks.customizeUiComponent(vulTable);
                callbacks.customizeUiComponent(scrollPane);
                callbacks.customizeUiComponent(tabs);

                // add the custom tab to Burp's UI
                callbacks.addSuiteTab(BurpExtender.this);

                // register ourselves as an HTTP listener
                callbacks.registerHttpListener(BurpExtender.this);
            }
        });
    }

    @Override
    public List<IScanIssue> doPassiveScan(
            IHttpRequestResponse baseRequestResponse) {
        this.stdout.println("[*]Passive Scan: " + baseRequestResponse.getHttpService());

        // 获取请求方法
        String method = this.helpers.analyzeRequest(baseRequestResponse).getMethod();

        // 提取请求参数
        List<IParameter> baseParams = this.helpers.analyzeRequest(baseRequestResponse.getRequest()).getParameters();
        StringBuilder sb = new StringBuilder();
        baseParams.forEach(p -> {
            if (sb.length() > 0) {
                sb.append("&" + p.getName() + "=" + p.getValue());
            } else {
                sb.append(p.getName() + "=" + p.getValue());
            }
        });
        String baseRequestParams = sb.toString();

//        scanCORS(baseRequestResponse, method, baseRequestParams);
        scanWebSocket(baseRequestResponse);

        return null;
    }

    @Override
    public List<IScanIssue> doActiveScan(
            IHttpRequestResponse baseRequestResponse,
            IScannerInsertionPoint insertionPoint) {
        // TODO here
        return null;
    }

    @Override
    public int consolidateDuplicateIssues(IScanIssue existingIssue,
                                          IScanIssue newIssue) {
        // TODO here
        return 0;
    }

    @Override
    public String getTabCaption() {
        return "跨站点WebSocket劫持漏洞扫描器";
    }

    @Override
    public Component getUiComponent() {
        return this.splitPane;
    }

    @Override
    public IHttpService getHttpService() {
        return this.currentlyDisplayedItem.getHttpService();
    }

    @Override
    public byte[] getRequest() {
        return this.currentlyDisplayedItem.getRequest();
    }

    @Override
    public byte[] getResponse() {
        return this.currentlyDisplayedItem.getResponse();
    }

    @Override
    public int getRowCount() {
        return vul_list.size();
    }

    @Override
    public int getColumnCount() {
        return 2;
    }

    @Override
    public String getColumnName(int columnIndex) {
        switch (columnIndex) {
            case 0:
                return "Name";
            case 1:
                return "URL";
            default:
                return "";
        }
    }

    @Override
    public Class<?> getColumnClass(int columnIndex) {
        return String.class;
    }

    @Override
    public Object getValueAt(int rowIndex, int columnIndex) {
        VulEntry vulEntry = vul_list.get(rowIndex);

        switch (columnIndex) {
            case 0:
                return vulEntry.vul_name;
            case 1:
                return vulEntry.url.toString();
            default:
                return "";
        }
    }

    @Override
    public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {

    }

    // extend JTable to handle cell selection
    private class Table extends JTable {
        public Table(TableModel tableModel) {
            super(tableModel);
        }

        @Override
        public void changeSelection(int row, int col, boolean toggle, boolean extend) {
            VulEntry vulEntry = vul_list.get(row);
            requestViewer.setMessage(vulEntry.baseRequestResponse.getRequest(), true);
            scanViewer.setMessage(vulEntry.fuzzingRequestResponse.getRequest(), true);
            responseViewer.setMessage(vulEntry.fuzzingRequestResponse.getResponse(), false);
            currentlyDisplayedItem = vulEntry.fuzzingRequestResponse;

            super.changeSelection(row, col, toggle, extend);
        }
    }


    private static class VulEntry {
        String vul_name;
        IHttpRequestResponsePersisted baseRequestResponse;
        IHttpRequestResponsePersisted fuzzingRequestResponse;
        URL url;

        public VulEntry(String vul_name, IHttpRequestResponsePersisted baseRequestResponse, IHttpRequestResponsePersisted fuzzingRequestResponse, URL url) {
            this.vul_name = vul_name;
            this.baseRequestResponse = baseRequestResponse;
            this.fuzzingRequestResponse = fuzzingRequestResponse;
            this.url = url;
        }
    }

    void scanWebSocket(IHttpRequestResponse baseRequestResponse) {
        IResponseInfo responseInfo = this.helpers.analyzeResponse(baseRequestResponse.getResponse());

        if (responseInfo.getStatusCode() == 101
                && responseInfo.getHeaders().contains(this.WebSocket_Word)
                && this.helpers.analyzeRequest(baseRequestResponse).getHeaders().contains(this.WebSocket_Word)) {

            // 替换Origin头为恶意域名
            List<String> fuzzing_headers = this.helpers.analyzeRequest(baseRequestResponse).getHeaders();
            fuzzing_headers.forEach(header -> {
                if (header.toLowerCase().startsWith("origin:")) {
                    Collections.replaceAll(fuzzing_headers, header, "Origin: " + this.Evil_Domain);
                }
            });

            byte[] fuzzingBody = this.helpers.buildHttpMessage(fuzzing_headers, null);
            IHttpRequestResponse fuzzingRequestResponse = this.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), fuzzingBody);

            if (this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getStatusCode() == 101
                    && this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getHeaders().contains(this.WebSocket_Word)) {
                this.stdout.println("[!]存在跨站点WebSocket劫持漏洞!");

                int row = this.vul_list.size();
                this.vul_list.add(
                        new VulEntry(
                                "跨站点WebSocket劫持漏洞",
                                this.callbacks.saveBuffersToTempFiles(baseRequestResponse),
                                this.callbacks.saveBuffersToTempFiles(fuzzingRequestResponse),
                                this.helpers.analyzeRequest(fuzzingRequestResponse).getUrl()
                        )
                );
                fireTableRowsInserted(row, row);
            }
        }
    }

}

效果：