Skip to content

Commit e4bf1d3

Browse files
whwlsfbwhwlsfb
committed
add ex-request.
1 parent ec1ee2a commit e4bf1d3

File tree

5 files changed

+76
-19
lines changed

5 files changed

+76
-19
lines changed

‎src/main/java/burp/scanner/Log4j2Scanner.java‎

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -319,15 +319,15 @@ private Map<String, ScanItem> crazyFuzz(IHttpRequestResponse baseRequestResponse
319319
domainParamMap.put(tmpDomain, param);
320320
}
321321
tmpRawRequest = helper.buildHttpMessage(helper.analyzeRequest(tmpRawRequest).getHeaders(), updateParams(rawBody, paramMap));
322-
IHttpRequestResponse tmpReq = parent.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
322+
IHttpRequestResponse tmpReq = sendRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
323323
for (Map.Entry<String, String> domainHeader : domainHeaderMap.entrySet()) {
324-
domainMap.put(domainHeader.getValue(), new ScanItem(domainHeader.getKey(), tmpReq));
324+
domainMap.put(domainHeader.getValue(), new ScanItem(domainHeader.getKey(), tmpReq, tmpRawRequest));
325325
}
326326
for (Map.Entry<String, IParameter> domainParam : domainParamMap.entrySet()) {
327-
domainMap.put(domainParam.getKey(), new ScanItem(domainParam.getValue(), tmpReq));
327+
domainMap.put(domainParam.getKey(), new ScanItem(domainParam.getValue(), tmpReq, tmpRawRequest));
328328
}
329329
} catch (Exception ex) {
330-
parent.stdout.println(ex);
330+
ex.printStackTrace(parent.stderr);
331331
}
332332
}
333333

@@ -361,8 +361,8 @@ private Map<String, ScanItem> headerFuzz(IHttpRequestResponse baseRequestRespons
361361
header.Value = poc.generate(tmpDomain);
362362
tmpHeaders.set(i, header.toString());
363363
byte[] tmpRawRequest = helper.buildHttpMessage(tmpHeaders, Arrays.copyOfRange(rawRequest, req.getBodyOffset(), rawRequest.length));
364-
IHttpRequestResponse tmpReq = parent.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
365-
domainMap.put(tmpDomain, new ScanItem(header.Name, tmpReq));
364+
IHttpRequestResponse tmpReq = sendRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
365+
domainMap.put(tmpDomain, new ScanItem(header.Name, tmpReq, tmpRawRequest));
366366
}
367367
}
368368
}
@@ -375,14 +375,14 @@ private Map<String, ScanItem> headerFuzz(IHttpRequestResponse baseRequestRespons
375375
domainHeaderMap.put(headerName, tmpDomain);
376376
}
377377
byte[] tmpRawRequest = helper.buildHttpMessage(tmpHeaders, Arrays.copyOfRange(rawRequest, req.getBodyOffset(), rawRequest.length));
378-
IHttpRequestResponse tmpReq = parent.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
378+
IHttpRequestResponse tmpReq = sendRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
379379
for (Map.Entry<String, String> domainHeader : domainHeaderMap.entrySet()) {
380-
domainMap.put(domainHeader.getValue(), new ScanItem(domainHeader.getKey(), tmpReq));
380+
domainMap.put(domainHeader.getValue(), new ScanItem(domainHeader.getKey(), tmpReq, tmpRawRequest));
381381
}
382382
}
383383

384384
} catch (Exception ex) {
385-
parent.stdout.println(ex);
385+
ex.printStackTrace(parent.stderr);
386386
}
387387
return domainMap;
388388
}
@@ -411,8 +411,8 @@ private Map<String, ScanItem> badJsonFuzz(IHttpRequestResponse baseRequestRespon
411411
Utils.GetRandomNumber(100, Integer.MAX_VALUE));
412412
IParameter fakeParam = helper.buildParameter("Bad-json Fuzz", exp, IParameter.PARAM_JSON);
413413
byte[] newRequest = helper.buildHttpMessage(tmpHeaders, finalPaylad.getBytes(StandardCharsets.UTF_8));
414-
IHttpRequestResponse tmpReq = parent.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), newRequest);
415-
domainMap.put(tmpDomain, new ScanItem(fakeParam, tmpReq));
414+
IHttpRequestResponse tmpReq = sendRequest(baseRequestResponse.getHttpService(), newRequest);
415+
domainMap.put(tmpDomain, new ScanItem(fakeParam, tmpReq, newRequest));
416416
}
417417
}
418418
return domainMap;
@@ -475,8 +475,8 @@ private Map<String, ScanItem> paramsFuzz(IHttpRequestResponse baseRequestRespons
475475
byte[] newBody = Utils.Replace(body, new int[]{param.getValueStart() - req.getBodyOffset(), param.getValueEnd() - req.getBodyOffset()}, exp.getBytes(StandardCharsets.UTF_8));
476476
tmpRawRequest = helper.buildHttpMessage(req.getHeaders(), newBody);
477477
}
478-
IHttpRequestResponse tmpReq = parent.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
479-
domainMap.put(tmpDomain, new ScanItem(param, tmpReq));
478+
IHttpRequestResponse tmpReq = sendRequest(baseRequestResponse.getHttpService(), tmpRawRequest);
479+
domainMap.put(tmpDomain, new ScanItem(param, tmpReq, tmpRawRequest));
480480
} catch (Exception ex) {
481481
parent.stdout.println(ex);
482482
}
@@ -511,14 +511,30 @@ private List<IScanIssue> finalCheck(IHttpRequestResponse baseRequestResponse, IR
511511
}
512512

513513
private Log4j2Issue getIssue(IHttpRequestResponse baseRequestResponse, IRequestInfo req, ScanItem item) {
514+
List<IHttpRequestResponse> requestResponses = new ArrayList<>();
515+
requestResponses.add(baseRequestResponse);
516+
String desp = String.format("Vulnerable param is \"%s\" in %s.", item.IsHeader ? item.HeaderName : item.Param.getName(), item.IsHeader ? "Header" : getTypeName(item.Param.getType()));
517+
if (item.TmpRequest != null) {
518+
requestResponses.add(item.TmpRequest);
519+
} else {
520+
desp += "<br/><br/>RawRequest:<br/><br/><pre>" + new String(item.RawRequest) + "</pre>";
521+
}
514522
return new Log4j2Issue(baseRequestResponse.getHttpService(),
515523
req.getUrl(),
516-
new IHttpRequestResponse[]{baseRequestResponse, item.TmpRequest},
524+
requestResponses.toArray(new IHttpRequestResponse[0]),
517525
"Log4j2 RCE Detected",
518-
String.format("Vulnerable param is \"%s\" in %s.", item.IsHeader ? item.HeaderName : item.Param.getName(), item.IsHeader ? "Header" : getTypeName(item.Param.getType())),
526+
desp,
519527
"High");
520528
}
521529

530+
private IHttpRequestResponse sendRequest(IHttpService httpService, byte[] rawRequest) {
531+
if (Config.getBoolean(Config.ENABLE_EX_REQUEST, true)) {
532+
HttpUtils.RawRequest(httpService, rawRequest, parent.helpers.analyzeRequest(httpService, rawRequest));
533+
return null;
534+
}
535+
return parent.callbacks.makeHttpRequest(httpService, rawRequest);
536+
}
537+
522538
private String getTypeName(int typeId) {
523539
switch (typeId) {
524540
case IParameter.PARAM_URL:

‎src/main/java/burp/ui/tabs/FuzzUIHandler.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ public class FuzzUIHandler {
1616

1717
private JComboBox fuzzModeSelector;
1818
private JComboBox scanModeSelector;
19+
private JCheckBox enabled_ex_request;
1920
private JCheckBox enabled_fuzz_header;
2021
private JCheckBox enabled_fuzz_url;
2122
private JCheckBox enabled_fuzz_body;
@@ -64,6 +65,11 @@ public JPanel getFuzzSettingPanel() {
6465
subPanel10.add(new JLabel("Scan Mode: "));
6566
subPanel10.add(scanModeSelector);
6667

68+
69+
JPanel subPanel11 = UIUtil.GetXJPanel();
70+
enabled_ex_request = new JCheckBox("Enable Ex-request");
71+
subPanel11.add(enabled_ex_request);
72+
6773
JPanel subPanel1 = UIUtil.GetXJPanel();
6874
enabled_fuzz_header = new JCheckBox("Enable Header Fuzz");
6975
subPanel1.add(enabled_fuzz_header);
@@ -128,6 +134,7 @@ public JPanel getFuzzSettingPanel() {
128134

129135
panel1.add(subPanel0);
130136
panel1.add(subPanel10);
137+
panel1.add(subPanel11);
131138
panel1.add(subPanel1);
132139
panel1.add(subPanel2);
133140
panel1.add(subPanel3);
@@ -153,6 +160,7 @@ private void loadConfig() {
153160
enabled_fuzz_body_multipart.setSelected(Config.getBoolean(Config.ENABLED_FUZZ_BODY_MULTIPART, true));
154161
enabled_fuzz_body_xml.setSelected(Config.getBoolean(Config.ENABLED_FUZZ_BODY_XML, true));
155162
enabled_fuzz_bad_json.setSelected(Config.getBoolean(Config.ENABLED_FUZZ_BAD_JSON, false));
163+
enabled_ex_request.setSelected(Config.getBoolean(Config.ENABLE_EX_REQUEST, true));
156164
}
157165

158166
private void saveConfig() {
@@ -167,6 +175,7 @@ private void saveConfig() {
167175
Config.setBoolean(Config.ENABLED_FUZZ_BODY_MULTIPART, enabled_fuzz_body_multipart.isSelected());
168176
Config.setBoolean(Config.ENABLED_FUZZ_BODY_XML, enabled_fuzz_body_xml.isSelected());
169177
Config.setBoolean(Config.ENABLED_FUZZ_BAD_JSON, enabled_fuzz_bad_json.isSelected());
178+
Config.setBoolean(Config.ENABLE_EX_REQUEST, enabled_ex_request.isSelected());
170179
JOptionPane.showMessageDialog(mainPanel, "Apply success!");
171180
}
172181

‎src/main/java/burp/utils/Config.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ public enum ScanMode {
3333
public static final String ENABLED_FUZZ_BAD_JSON = "enabled_fuzz_bad_json";
3434
public static final String FUZZ_MODE = "fuzz_mode";
3535
public static final String SCAN_MODE = "scan_mode";
36+
public static final String ENABLE_EX_REQUEST = "enabled_ex_request";
3637

3738
public static String get(String name) {
3839
return Utils.Callback.loadExtensionSetting(name);

‎src/main/java/burp/utils/HttpUtils.java‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,21 @@
11
package burp.utils;
22

3-
import okhttp3.CacheControl;
4-
import okhttp3.Request;
3+
import burp.BurpExtender;
4+
import burp.IHttpService;
5+
import burp.IRequestInfo;
6+
import okhttp3.*;
57

8+
import java.io.PrintStream;
9+
import java.util.Arrays;
610
import java.util.Calendar;
11+
import java.util.List;
12+
import java.util.concurrent.TimeUnit;
713

814
public class HttpUtils {
915
public static CacheControl NoCache = new CacheControl.Builder().noCache().noStore().build();
16+
static OkHttpClient client = new OkHttpClient().newBuilder().
17+
connectTimeout(3000, TimeUnit.MILLISECONDS).
18+
callTimeout(500, TimeUnit.MILLISECONDS).build();
1019

1120
public static Request.Builder GetDefaultRequest(String url) {
1221
int fakeFirefoxVersion = Utils.GetRandomNumber(45, 94 + Calendar.getInstance().get(Calendar.YEAR) - 2021);
@@ -20,4 +29,23 @@ public static String getUrlFileExt(String url) {
2029
String pureUrl = url.substring(0, url.contains("?") ? url.indexOf("?") : url.length());
2130
return (pureUrl.lastIndexOf(".") > -1 ? pureUrl.substring(pureUrl.lastIndexOf(".") + 1) : "").toLowerCase();
2231
}
32+
33+
public static void RawRequest(IHttpService httpService, byte[] rawRequest, IRequestInfo req) {
34+
byte[] body = Arrays.copyOfRange(rawRequest, req.getBodyOffset(), rawRequest.length);
35+
List<String> headers = req.getHeaders();
36+
new PrintStream(Utils.Callback.getStderr()).println(req.getUrl());
37+
Request.Builder requestBuilder = new Request.Builder()
38+
.url(req.getUrl());
39+
for (int i = 1; i < headers.size(); i++) {
40+
HttpHeader header = new HttpHeader(headers.get(i));
41+
requestBuilder.header(header.Name, header.Value);
42+
}
43+
requestBuilder.method(req.getMethod(), RequestBody.create(body));
44+
requestBuilder.cacheControl(NoCache);
45+
try {
46+
client.newCall(requestBuilder.build()).execute();
47+
} catch (Exception ex) {
48+
ex.printStackTrace(new PrintStream(Utils.Callback.getStderr()));
49+
}
50+
}
2351
}

‎src/main/java/burp/utils/ScanItem.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,22 @@
44
import burp.IParameter;
55

66
public class ScanItem {
7-
public ScanItem(IParameter param, IHttpRequestResponse tmpreq) {
7+
public ScanItem(IParameter param, IHttpRequestResponse tmpreq, byte[] rawRequest) {
88
this.Param = param;
99
this.TmpRequest = tmpreq;
10+
this.RawRequest = rawRequest;
1011
}
1112

12-
public ScanItem(String headerName, IHttpRequestResponse tmpreq) {
13+
public ScanItem(String headerName, IHttpRequestResponse tmpreq, byte[] rawRequest) {
1314
this.IsHeader = true;
1415
this.HeaderName = headerName;
1516
this.TmpRequest = tmpreq;
17+
this.RawRequest = rawRequest;
1618
}
1719

1820
public String HeaderName;
1921
public boolean IsHeader;
2022
public IParameter Param;
2123
public IHttpRequestResponse TmpRequest;
24+
public byte[] RawRequest;
2225
}

0 commit comments

Comments
 (0)