Burp Suite Montoya API Examples

The Custom Logger Example Extension demonstrates how to implement a suite-wide HTTP logger within the Burp Suite UI. It provides a centralized view of HTTP traffic generated by all Burp tools.

Key capabilities demonstrated include:

• Custom UI Integration: Creating a new tab within the main Burp Suite user interface.
• Traffic Logging: Intercepting items via the HttpHandler and adding them to a centralized log.
• Advanced UI Components: Using a splitpane to display a table of logged items alongside a read-only editor for inspecting specific requests and responses.
• Interactive Inspection: Allowing users to view full request/response details by selecting rows in the traffic table.

This extension demonstrates how to extend Burp's scanning capabilities by implementing both passive and active scan checks.

Key techniques implemented include:

• Registering checks: Adding both passive and active scan checks to the Burp engine.
• Active Scanning with Payloads: Using the AuditInsertionPoint to construct requests for active scanning using specific payloads.
• Response Analysis: Using helper methods to search responses for relevant match strings.
• UI Highlighting: Providing a MarkedHttpRequestResponse to highlight specific portions of requests and responses in the Burp UI.
• Issue Reporting: Synchronously reporting custom scan issues when checks trigger.
• Issue Consolidation: Guiding Burp on when to consolidate duplicated issues at the same URL (e.g., preventing duplicate alerts when the same item is scanned multiple times).

This extension demonstrates how to perform various actions on requests and responses passing through the Burp Proxy by registering a Proxy handler.

Outgoing Requests

• Dropping Requests: All POST requests are dropped.
• URL Filtering: Requests containing foo in the URL are ignored and not intercepted.
• JSON Highlighting: If the Content-Type is JSON, the request is highlighted RED and standard Burp interception rules are applied.
• Interception: All other requests (that don't match the above criteria) are intercepted.
• User Modification: Requests modified by the user are continued as normal.

Incoming Responses

• String Matching: Any response containing the string username is highlighted BLUE.
• Standard Behavior: All other responses follow standard Burp interception rules.

This extension demonstrates how to intercept and modify both outgoing requests and incoming responses passing through any tool in Burp Suite using the Montoya API.

Outgoing Request Logic:

• Intercepts POST requests.
• Logs the request body to the Burp output.
• Adds a comment to the request.
• Appends a specific URL parameter to the request.

Incoming Response Logic:

• Checks if the original request contained a Content-Length header.
• If present, applies a BLUE highlight to the response.

This example extension demonstrates how to register listeners for various runtime events within Burp Suite using the Montoya API. It serves as a template for intercepting and reacting to specific lifecycle and traffic events.

Key events covered in this example include:

• HTTP requests and responses: Monitoring traffic across all Burp tools.
• Proxy interception: Monitoring HTTP messages specifically intercepted by the Proxy.
• Scan issues: Detecting when new scan issues are added to Burp.
• Extension lifecycle: Handling the event when the extension is unloaded by the user.

The Hello World extension is a minimal implementation designed to demonstrate fundamental Burp Suite extension capabilities using the Montoya API. It covers basic interaction with Burp's UI and logging systems, specifically:

• Naming the extension: Setting the display name that appears in the Burp Suite user interface.
• Logging to streams: Writing messages to the standard output and error streams within Burp.
• Alerting: Writing messages directly to the main Burp alerts log.
• Error reporting: Demonstrating how exceptions are caught and reported to the user via the Burp UI.

The Persistence Example Extension demonstrates how to save and load data to the Burp Suite project file using the Montoya API. It covers three primary use cases:

1. Simple Data Persistence: Saves and loads a simple incrementing integer. The extension logs how many times Burp or the extension has been restarted.
2. HTTP Request Persistence: Saves and loads extension-built HTTP requests. When Burp is restarted or the extension is reloaded, these requests are sent to the Repeater with an incrementing tab counter.
3. Persisted Lists for Request/Response History: Saves the last 5 requests/responses issued by Burp. It uses Persisted Lists to automatically handle the saving and loading of the data stored in the list. When Burp restarts or the extension reloads, these 5 pairs are printed to the output log.

The Traffic Redirector extension intercepts outgoing HTTP requests and redirects them from a source host to a destination host. This is useful for testing applications that have moved to different staging URLs while allowing you to maintain your existing Burp Suite site map.

Logic flow:

1. The extension registers an HTTP handler.
2. For every outgoing request, it retrieves the HTTPService associated with the request.
3. It checks if the host in the HTTPService matches a predefined "from" host.
4. If it matches, it constructs a new HTTPService using the "to" host while keeping all other request details (port, protocol, etc.) unchanged.
5. It returns the modified request with the new HTTPService to Burp Suite.

This extension demonstrates how to intercept and manipulate WebSocket messages passing through any tool in Burp Suite using the Montoya API.

It follows this lifecycle:

1. Registration: The extension registers a WebSocketCreatedHandler.
2. Initialization: When a new WebSocket connection is created, the extension automatically sends an initial text message to the server.
3. Listening: The extension registers a message listener for that specific WebSocket.
4. Manipulation: The extension monitors incoming messages from the client. If a message contains the literal text password, the extension intercepts it and replaces the content with a Base64 encoded version of that message.

To add custom items to Burp Suite's context menus, implement the ContextMenuItemsProvider interface. This allows your extension to provide a list of JMenuItem objects when a user right-clicks in different parts of the application (such as the Target, Proxy, or Logger tabs).

This extension demonstrates two specific behaviors for providing menu items:

1. Message Editor Context: If the user right-clicks within a message editor, the provider can return items specific to that editor context.
2. Table Item Context: If the user right-clicks on a row in a table (like the Proxy history), the provider can identify the selected item and return menu items that act upon that specific HttpRequestResponse.