In part 2 of this series we covered the "evt_proxy_message" method. In part 3 of this series we will cover the two methods shown below which have "checks" next to them.
√ evt_http_message
√ evt_scan_issue
doActiveScan
doPassiveScan
excludeFromScope
includeInScope
isInScope
issueAlert
makeHttpRequest
sendToIntruder
sendToRepeater
sendToSpider
So let's cover each individually with brief explanation and a code example.
You can find sample scripts for each of these under the examples directory of the buby-script repo located
Here.
EVT_HTTP_MESSAGE---------------------------------The following code will allow you to obtain methods exposed by the message_info object (which is a class):
The 3 separate objects that make up the param are:
tool_name => This is a string value, it is the name of the tool for which the message originated. Examples include proxy, scanner and repeater.
is_request => Boolean value (true/false), this returns true when it is a request and false when a response.
message_info => This is a class. It is an instance of the IHttpRequestResponse Java class. So there are methods such as get_comment, set_comment and getUrl exposed.
An example of using evt_http_message can be seen here (code):
....and the result
w00t!
So what does the code actually do?
Lines 1 and 2 - Define the method and separate param into 3 separate objects.
Lines 3-5Ln 3 If the tool the message originated from was the spider and this is NOT a request proceed to Ln 4.Ln4 If the response status code is 200 (OK), then move to Ln 5.Ln 5 Puts "Yo, we received a 200 FTW!" to the console.
Lines 6-9 Are closing statements/method and passing the param back up to the superclass method.
You can find another example using this method in the zlib_inflate.rb script.
EVT_SCAN_ISSUE---------------------------
The following code will allow you obtain methods exposed by the issue object (which is a class):
Only one object is exposed, it is a class, it is called issue. Some of the methods exposed by this class are
-issue_name
-severity
-confidence
-protocol
-host
-url
-port
-issue_detail
-issue_background
-remediation_detail
-remediation_background
The following code:
...produces:
Lets step through the code1. def prnt(*objs)
2. strn, meth = objs
3. str = ''
4. str << "\n#{strn}\n"
5. str << '=' * strn.length + "\n\n"
6. str << "#{meth}\n"
7. puts str
8. end
Lines 1-2 - Defines the method (prnt) and separates objs into two objects (strn, meth)
.
Lines 3-4 - This defines a string instance variable (str), and then proceeds to put the strn object onto it.
Lines 5-7 - The length of strn gets multiplied by '=' so that we can create the following visual....
Example:
something
=========
...then we push meth onto the string and then we "puts" or print it to the console.
Lets step through the second method "hm_prnt".1. def hm_prnt(*objs)
2. strn, meth = objs
3. str = ''
4. str << "\n#{strn}\n"
5. str << '=' * strn.length + "\n\n"
6. meth.each do |itm|
7. str << "#{itm.request_headers}\n"
8. str << "#{itm.request_body}\n"
9. str << "#{itm.response_headers}\n"
10. str << "#{itm.response_body}\n"
11. end
12. puts str
13 . end
Lines 1-2 - Defines the method (prnt) and separates objs into two objects (strn, meth)
.
Lines 3-4 - This defines a string instance variable (str), and then proceeds to put the strn object onto it.
Lines 6-10 - We take the meth object which is an Array, we iterate thru each item in the array, convert it to a string while calling the four methods it exposes (request_headers, request_body, response.headers, and response_body). Now these methods all belong to http_messages and itm really represents the http_messages class. So when we are iterating thru this array we are really iterating thru an array containing a bunch of http_messages classes. Hopefully that makes sense.
F
inally, we need to discuss the $burp.evt_scan_issue method.
1. def $burp.evt_scan_issue(issue)
2. meth_arry = [
3. 'issue_name',
4. 'severity',
5. 'confidence',
6. 'protocol',
7. 'host',
8. 'url',
9. 'port',
10. 'issue_detail',
11. 'issue_background',
12. 'remediation_detail',
13. 'remediation_background',
14. ]
15.
16. meth_arry.each do |meth|
17. prnt("#{meth}", "#{issue.send("#{meth}")}")
18. end
19.
20. hm_prnt('http_messages', issue.http_messages)
21.
22. end
Line 1 - Defines the method ($burp.evt_scan_issue) and instantiates the "issue" object.
Lines 2-14 - Creates an Array called "meth_array" which consists of methods associated with the issue object instantiated on line 1.
Lines 16-18 - Iterates thru the meth_arry we created on line 2 picking out each method and then sends the method name and the method itself to prnt.
Line 20 - The http_message method attached to the issue object isn't in the meth_arry because it can't be called directly and converted to a string. This is because http_message is a an array of classes. Each class has it's own methods. So, we made a special prnt method for it called hm_prnt.
Well that is all for Part 3 of this series. Part 4 will cover some of the other methods listed in the first part of this post. If you have any feedback please provide it so that the series can be improved upon.
Happy Hacking,
~cktricky
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Packet Storm Security Headlines
Sophos security news
Penetration Testing
SecuriTeam
BackTrack Linux Forums
Threatpost
SecDocs
carnal0wnage.attackresearch.com
Carnal0wnage
Darknet
The Exploitant
Hack a Day
Wirevolution
