Skip to content

Commit c224b6a

Browse files
federicodottafedericodotta
committed
Small fixes to improve detection
1 parent 1789e46 commit c224b6a

1 file changed

Lines changed: 14 additions & 23 deletions

File tree

‎src/main/java/burp/BurpExtender.java‎

Lines changed: 14 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1208,12 +1208,13 @@ public List<IScanIssue> doActiveScan(IHttpRequestResponse baseRequestResponse, I
12081208
while (iter.hasNext()) {
12091209

12101210
currentKey = iter.next();
1211+
12111212
byte[] newPayload = null;
12121213

12131214
if(magicPos > -1) {
12141215
newPayload = ArrayUtils.addAll(Arrays.copyOfRange(insertionPointBaseValue, 0, magicPos),currentPayloads.get(currentKey));
12151216
} else if(magicPosBase64 > -1) {
1216-
newPayload = ArrayUtils.addAll(Arrays.copyOfRange(insertionPointBaseValue, 0, magicPosBase64),Base64.encodeBase64URLSafe(currentPayloads.get(currentKey)));
1217+
newPayload = ArrayUtils.addAll(Arrays.copyOfRange(insertionPointBaseValue, 0, magicPosBase64),Base64.encodeBase64(currentPayloads.get(currentKey)));
12171218
} else if(magicPosAsciiHex > -1) {
12181219
newPayload = ArrayUtils.addAll(Arrays.copyOfRange(insertionPointBaseValue, 0, magicPosAsciiHex),Hex.encodeHexString(currentPayloads.get(currentKey)).getBytes());
12191220
} else if(magicPosBase64Gzip > -1) {
@@ -1222,6 +1223,7 @@ public List<IScanIssue> doActiveScan(IHttpRequestResponse baseRequestResponse, I
12221223
newPayload = ArrayUtils.addAll(Arrays.copyOfRange(insertionPointBaseValue, 0, magicPosGzip),gzipData(currentPayloads.get(currentKey)));
12231224
}
12241225

1226+
int[] markers = insertionPoint.getPayloadOffsets(newPayload);
12251227
byte[] newRequest = insertionPoint.buildRequest(newPayload);
12261228
long startTime = System.nanoTime();
12271229
IHttpRequestResponse checkRequestResponse = callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), newRequest);
@@ -1234,40 +1236,29 @@ public List<IScanIssue> doActiveScan(IHttpRequestResponse baseRequestResponse, I
12341236
collaboratorInteractions = collaboratorContext.fetchCollaboratorInteractionsFor(dnsCollaboratorUrls.get(currentKey));
12351237
}
12361238

1237-
if( (currentKey.contains("Sleep") && ((int)duration) >= 10 ) || (currentKey.contains("DNS") && collaboratorInteractions.size() > 0 ) ) {
1239+
if( (currentKey.contains("Sleep") && ((int)duration) >= 9 ) || (currentKey.contains("DNS") && collaboratorInteractions.size() > 0 ) ) {
12381240

12391241
// Vulnerability found
12401242

12411243
// Adding of marker for the vulnerability report
12421244
List<int[]> requestMarkers = new ArrayList<int[]>();
12431245
int markerStart = 0;
1244-
int markerEnd = 0;
1246+
int markerEnd = markers[1];
12451247
String issueEncoding = "";
12461248

12471249
if(magicPos > -1) {
1248-
markerStart = helpers.indexOf(newRequest, helpers.urlEncode(currentPayloads.get(currentKey)), false, 0, newRequest.length);
1249-
markerEnd = markerStart + helpers.urlEncode(currentPayloads.get(currentKey)).length;
1250+
markerStart = markers[0] + magicPos;
12501251
}else if(magicPosBase64 > -1) {
1251-
markerStart = helpers.indexOf(newRequest, Base64.encodeBase64URLSafe(currentPayloads.get(currentKey)), false, 0, newRequest.length);
1252-
markerEnd = markerStart + helpers.urlEncode(Base64.encodeBase64URLSafe(currentPayloads.get(currentKey))).length;
1252+
markerStart = markers[0] + magicPosBase64;
12531253
issueEncoding = issueEncoding + " (encoded in Base64)";
12541254
} else if(magicPosAsciiHex > -1) {
1255-
markerStart = helpers.indexOf(newRequest, Hex.encodeHexString(currentPayloads.get(currentKey)).getBytes(), false, 0, newRequest.length);
1256-
markerEnd = markerStart + helpers.urlEncode(Hex.encodeHexString(currentPayloads.get(currentKey)).getBytes()).length;
1255+
markerEnd = markers[0] + magicPosAsciiHex;
12571256
issueEncoding = issueEncoding + " (encoded in Ascii HEX)";
12581257
} else if(magicPosBase64Gzip > -1) {
1259-
//Need to use more comprehensive URL encoding as / doesn't get encoded
1260-
try {
1261-
markerStart = helpers.indexOf(newRequest, URLEncoder.encode(new String(Base64.encodeBase64(gzipData(currentPayloads.get(currentKey)))), "UTF-8").getBytes(), false, 0, newRequest.length);
1262-
markerEnd = markerStart + URLEncoder.encode(new String(Base64.encodeBase64(gzipData(currentPayloads.get(currentKey)))), "UTF-8").getBytes().length;
1263-
issueEncoding = issueEncoding + " (encoded in Base64 and Gzipped)";
1264-
}
1265-
catch (Exception ex) {
1266-
stderr.println(ex.getMessage());
1267-
}
1258+
markerEnd = markers[0] + magicPosBase64Gzip;
1259+
issueEncoding = issueEncoding + " (encoded in Base64 and Gzipped)";
12681260
} else {
1269-
markerStart = helpers.indexOf(newRequest, gzipData(currentPayloads.get(currentKey)), false, 0, newRequest.length);
1270-
markerEnd = markerStart + helpers.urlEncode(gzipData(currentPayloads.get(currentKey))).length;
1261+
markerEnd = markers[0] + magicPosGzip;
12711262
issueEncoding = issueEncoding + " (encoded/compressed with Gzip)";
12721263
}
12731264

@@ -1384,7 +1375,7 @@ else if(!urlBodyAlreadyScanned.contains(requestInfo.getUrl().toExternalForm())){
13841375
newBody = ArrayUtils.addAll(Arrays.copyOfRange(request, bodyOffset, magicPos),currentPayloads.get(currentKey));
13851376
} else if(magicPosBase64 > -1) {
13861377
// Encode the payload in Base64
1387-
newBody = ArrayUtils.addAll(Arrays.copyOfRange(request, bodyOffset, magicPosBase64),Base64.encodeBase64URLSafe(currentPayloads.get(currentKey)));
1378+
newBody = ArrayUtils.addAll(Arrays.copyOfRange(request, bodyOffset, magicPosBase64),Base64.encodeBase64(currentPayloads.get(currentKey)));
13881379
} else if(magicPosAsciiHex > -1) {
13891380
// Encode the payload in Ascii HEX
13901381
newBody = ArrayUtils.addAll(Arrays.copyOfRange(request, bodyOffset, magicPosAsciiHex),Hex.encodeHexString(currentPayloads.get(currentKey)).getBytes());
@@ -1407,7 +1398,7 @@ else if(!urlBodyAlreadyScanned.contains(requestInfo.getUrl().toExternalForm())){
14071398
collaboratorInteractions = collaboratorContext.fetchCollaboratorInteractionsFor(dnsCollaboratorUrls.get(currentKey));
14081399
}
14091400

1410-
if( (currentKey.contains("Sleep") && ((int)duration) >= 10 ) || (currentKey.contains("DNS") && collaboratorInteractions.size() > 0 ) ) {
1401+
if( (currentKey.contains("Sleep") && ((int)duration) >= 9 ) || (currentKey.contains("DNS") && collaboratorInteractions.size() > 0 ) ) {
14111402

14121403
// Vulnerability found
14131404

@@ -2109,7 +2100,7 @@ public void executeManualTest(List<Transformation> transformations, String testT
21092100
*/
21102101

21112102
//if(( testType.equals(BurpExtender.TEST_SLEEP) && (((int)duration) >= 10)) || ( testType.equals(BurpExtender.TEST_CPU) && (((int)duration) >= 60)) ){
2112-
if( ( ( testType.equals(BurpExtender.TEST_SLEEP) || testType.equals(BurpExtender.TEST_CPU) ) && (((int)duration) >= 10) ) || (( testType.equals(BurpExtender.TEST_DNS) || testType.equals(BurpExtender.TEST_URLDNS) ) && ( collaboratorInteractions.size() > 0 ) ) ) {
2103+
if( ( ( testType.equals(BurpExtender.TEST_SLEEP) || testType.equals(BurpExtender.TEST_CPU) ) && (((int)duration) >= 9) ) || (( testType.equals(BurpExtender.TEST_DNS) || testType.equals(BurpExtender.TEST_URLDNS) ) && ( collaboratorInteractions.size() > 0 ) ) ) {
21132104

21142105
positiveResult = true;
21152106

0 commit comments

Comments
 (0)