Version: 3.0 Update
This commit is contained in:
gh0stkey
115
src/main/java/hae/instances/editor/RequestEditor.java
Normal file
115
src/main/java/hae/instances/editor/RequestEditor.java
Normal file
@@ -0,0 +1,115 @@
|
||||
package hae.instances.editor;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.ui.editor.extension.EditorCreationContext;
|
||||
import burp.api.montoya.ui.editor.extension.ExtensionProvidedHttpRequestEditor;
|
||||
import burp.api.montoya.ui.editor.extension.HttpRequestEditorProvider;
|
||||
import burp.api.montoya.core.ByteArray;
|
||||
import burp.api.montoya.core.Range;
|
||||
import burp.api.montoya.http.message.HttpRequestResponse;
|
||||
import burp.api.montoya.http.message.requests.HttpRequest;
|
||||
import burp.api.montoya.ui.Selection;
|
||||
import hae.component.board.Datatable;
|
||||
import hae.instances.http.utils.MessageProcessor;
|
||||
|
||||
import javax.swing.*;
|
||||
import java.awt.*;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class RequestEditor implements HttpRequestEditorProvider {
|
||||
private final MontoyaApi api;
|
||||
|
||||
public RequestEditor(MontoyaApi api) {
|
||||
this.api = api;
|
||||
}
|
||||
|
||||
@Override
|
||||
public ExtensionProvidedHttpRequestEditor provideHttpRequestEditor(EditorCreationContext editorCreationContext) {
|
||||
return new Editor(api, editorCreationContext);
|
||||
}
|
||||
|
||||
private static class Editor implements ExtensionProvidedHttpRequestEditor {
|
||||
private final MontoyaApi api;
|
||||
private final EditorCreationContext creationContext;
|
||||
private final MessageProcessor messageProcessor;
|
||||
private HttpRequestResponse requestResponse;
|
||||
|
||||
private JTabbedPane jTabbedPane = new JTabbedPane();
|
||||
|
||||
public Editor(MontoyaApi api, EditorCreationContext creationContext)
|
||||
{
|
||||
this.api = api;
|
||||
this.creationContext = creationContext;
|
||||
this.messageProcessor = new MessageProcessor(api);
|
||||
}
|
||||
|
||||
@Override
|
||||
public HttpRequest getRequest() {
|
||||
return requestResponse.request();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setRequestResponse(HttpRequestResponse requestResponse) {
|
||||
this.requestResponse = requestResponse;
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized boolean isEnabledFor(HttpRequestResponse requestResponse) {
|
||||
HttpRequest request = requestResponse.request();
|
||||
if (request != null && !request.bodyToString().equals("Loading...")) {
|
||||
List<Map<String, String>> result = messageProcessor.processRequest("", request, false);
|
||||
jTabbedPane = generateTabbedPaneFromResultMap(api, result);
|
||||
return jTabbedPane.getTabCount() > 0;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String caption() {
|
||||
return "MarkInfo";
|
||||
}
|
||||
|
||||
@Override
|
||||
public Component uiComponent() {
|
||||
return jTabbedPane;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Selection selectedData() {
|
||||
return new Selection() {
|
||||
@Override
|
||||
public ByteArray contents() {
|
||||
return ByteArray.byteArray(Datatable.getSelectedData(((Datatable) jTabbedPane.getSelectedComponent()).getDataTable()));
|
||||
}
|
||||
|
||||
@Override
|
||||
public Range offsets() {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isModified() {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public static JTabbedPane generateTabbedPaneFromResultMap(MontoyaApi api, List<Map<String, String>> result) {
|
||||
JTabbedPane tabbedPane = new JTabbedPane();
|
||||
if (result != null && !result.isEmpty() && result.size() > 0) {
|
||||
Map<String, String> dataMap = result.get(0);
|
||||
if (dataMap != null && !dataMap.isEmpty() && dataMap.size() > 0) {
|
||||
dataMap.keySet().forEach(i->{
|
||||
String[] extractData = dataMap.get(i).split("\n");
|
||||
Datatable dataPanel = new Datatable(api, i, Arrays.asList(extractData));
|
||||
tabbedPane.addTab(i, dataPanel);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
return tabbedPane;
|
||||
}
|
||||
}
|
||||
98
src/main/java/hae/instances/editor/ResponseEditor.java
Normal file
98
src/main/java/hae/instances/editor/ResponseEditor.java
Normal file
@@ -0,0 +1,98 @@
|
||||
package hae.instances.editor;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.http.message.HttpRequestResponse;
|
||||
import burp.api.montoya.http.message.responses.HttpResponse;
|
||||
import burp.api.montoya.ui.editor.extension.EditorCreationContext;
|
||||
import burp.api.montoya.ui.editor.extension.ExtensionProvidedHttpResponseEditor;
|
||||
import burp.api.montoya.ui.editor.extension.HttpResponseEditorProvider;
|
||||
import burp.api.montoya.core.ByteArray;
|
||||
import burp.api.montoya.core.Range;
|
||||
import burp.api.montoya.ui.Selection;
|
||||
import hae.component.board.Datatable;
|
||||
import hae.instances.http.utils.MessageProcessor;
|
||||
|
||||
import javax.swing.*;
|
||||
import java.awt.*;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class ResponseEditor implements HttpResponseEditorProvider {
|
||||
private final MontoyaApi api;
|
||||
|
||||
public ResponseEditor(MontoyaApi api) {
|
||||
this.api = api;
|
||||
}
|
||||
|
||||
@Override
|
||||
public ExtensionProvidedHttpResponseEditor provideHttpResponseEditor(EditorCreationContext editorCreationContext) {
|
||||
return new Editor(api, editorCreationContext);
|
||||
}
|
||||
|
||||
private static class Editor implements ExtensionProvidedHttpResponseEditor {
|
||||
private final MontoyaApi api;
|
||||
private final EditorCreationContext creationContext;
|
||||
private final MessageProcessor messageProcessor;
|
||||
private HttpRequestResponse requestResponse;
|
||||
|
||||
private JTabbedPane jTabbedPane = new JTabbedPane();
|
||||
|
||||
public Editor(MontoyaApi api, EditorCreationContext creationContext)
|
||||
{
|
||||
this.api = api;
|
||||
this.creationContext = creationContext;
|
||||
this.messageProcessor = new MessageProcessor(api);
|
||||
}
|
||||
|
||||
@Override
|
||||
public HttpResponse getResponse() {
|
||||
return requestResponse.response();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setRequestResponse(HttpRequestResponse requestResponse) {
|
||||
this.requestResponse = requestResponse;
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized boolean isEnabledFor(HttpRequestResponse requestResponse) {
|
||||
HttpResponse request = requestResponse.response();
|
||||
if (request != null && !request.bodyToString().equals("Loading...")) {
|
||||
List<Map<String, String>> result = messageProcessor.processResponse("", request, false);
|
||||
jTabbedPane = RequestEditor.generateTabbedPaneFromResultMap(api, result);
|
||||
return jTabbedPane.getTabCount() > 0;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String caption() {
|
||||
return "MarkInfo";
|
||||
}
|
||||
|
||||
@Override
|
||||
public Component uiComponent() {
|
||||
return jTabbedPane;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Selection selectedData() {
|
||||
return new Selection() {
|
||||
@Override
|
||||
public ByteArray contents() {
|
||||
return ByteArray.byteArray(Datatable.getSelectedData(((Datatable) jTabbedPane.getSelectedComponent()).getDataTable()));
|
||||
}
|
||||
|
||||
@Override
|
||||
public Range offsets() {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isModified() {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
94
src/main/java/hae/instances/editor/WebSocketEditor.java
Normal file
94
src/main/java/hae/instances/editor/WebSocketEditor.java
Normal file
@@ -0,0 +1,94 @@
|
||||
package hae.instances.editor;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.core.ByteArray;
|
||||
import burp.api.montoya.core.Range;
|
||||
import burp.api.montoya.ui.Selection;
|
||||
import burp.api.montoya.ui.contextmenu.WebSocketMessage;
|
||||
import burp.api.montoya.ui.editor.extension.*;
|
||||
import hae.component.board.Datatable;
|
||||
import hae.instances.http.utils.MessageProcessor;
|
||||
|
||||
import javax.swing.*;
|
||||
import java.awt.*;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class WebSocketEditor implements WebSocketMessageEditorProvider {
|
||||
private final MontoyaApi api;
|
||||
|
||||
public WebSocketEditor(MontoyaApi api) {
|
||||
this.api = api;
|
||||
}
|
||||
|
||||
@Override
|
||||
public ExtensionProvidedWebSocketMessageEditor provideMessageEditor(EditorCreationContext editorCreationContext) {
|
||||
return new Editor(api, editorCreationContext);
|
||||
}
|
||||
|
||||
private static class Editor implements ExtensionProvidedWebSocketMessageEditor {
|
||||
private final MontoyaApi api;
|
||||
private final EditorCreationContext creationContext;
|
||||
private final MessageProcessor messageProcessor;
|
||||
private ByteArray message;
|
||||
|
||||
private JTabbedPane jTabbedPane = new JTabbedPane();
|
||||
|
||||
public Editor(MontoyaApi api, EditorCreationContext creationContext) {
|
||||
this.api = api;
|
||||
this.creationContext = creationContext;
|
||||
this.messageProcessor = new MessageProcessor(api);
|
||||
}
|
||||
|
||||
@Override
|
||||
public ByteArray getMessage() {
|
||||
return message;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setMessage(WebSocketMessage webSocketMessage) {
|
||||
this.message = webSocketMessage.payload();
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isEnabledFor(WebSocketMessage webSocketMessage) {
|
||||
String websocketMessage = webSocketMessage.payload().toString();
|
||||
if (!websocketMessage.isEmpty()) {
|
||||
List<Map<String, String>> result = messageProcessor.processMessage("", websocketMessage, false);
|
||||
jTabbedPane = RequestEditor.generateTabbedPaneFromResultMap(api, result);
|
||||
return jTabbedPane.getTabCount() > 0;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String caption() {
|
||||
return "MarkInfo";
|
||||
}
|
||||
|
||||
@Override
|
||||
public Component uiComponent() {
|
||||
return jTabbedPane;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Selection selectedData() {
|
||||
return new Selection() {
|
||||
@Override
|
||||
public ByteArray contents() {
|
||||
return ByteArray.byteArray(Datatable.getSelectedData(((Datatable) jTabbedPane.getSelectedComponent()).getDataTable()));
|
||||
}
|
||||
|
||||
@Override
|
||||
public Range offsets() {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isModified() {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
87
src/main/java/hae/instances/http/HttpMessageHandler.java
Normal file
87
src/main/java/hae/instances/http/HttpMessageHandler.java
Normal file
@@ -0,0 +1,87 @@
|
||||
package hae.instances.http;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.core.Annotations;
|
||||
import burp.api.montoya.core.HighlightColor;
|
||||
import burp.api.montoya.http.handler.*;
|
||||
import burp.api.montoya.http.message.HttpRequestResponse;
|
||||
import burp.api.montoya.http.message.requests.HttpRequest;
|
||||
import hae.Config;
|
||||
import hae.component.board.message.MessageTableModel;
|
||||
import hae.instances.http.utils.MessageProcessor;
|
||||
import hae.utils.string.StringProcessor;
|
||||
|
||||
import java.util.*;
|
||||
|
||||
public class HttpMessageHandler implements HttpHandler {
|
||||
private final MontoyaApi api;
|
||||
private MessageTableModel messageTableModel;
|
||||
private final MessageProcessor messageProcessor;
|
||||
private String host;
|
||||
|
||||
// Montoya API对HTTP消息的处理分为了请求和响应，因此此处设置高亮和标记需要使用全局变量的方式，以此兼顾请求和响应
|
||||
// 同时采用 ThreadLocal 来保证多线程并发的情况下全局变量的安全性
|
||||
private final ThreadLocal<List<String>> colorList = ThreadLocal.withInitial(ArrayList::new);
|
||||
private final ThreadLocal<List<String>> commentList = ThreadLocal.withInitial(ArrayList::new);
|
||||
private final ThreadLocal<Boolean> matches = ThreadLocal.withInitial(() -> false);
|
||||
private final ThreadLocal<HttpRequest> httpRequest = new ThreadLocal<>();
|
||||
|
||||
public HttpMessageHandler(MontoyaApi api, MessageTableModel messageTableModel) {
|
||||
this.api = api;
|
||||
this.messageTableModel = messageTableModel;
|
||||
this.messageProcessor = new MessageProcessor(api);
|
||||
}
|
||||
|
||||
@Override
|
||||
public RequestToBeSentAction handleHttpRequestToBeSent(HttpRequestToBeSent httpRequestToBeSent) {
|
||||
colorList.get().clear();
|
||||
commentList.get().clear();
|
||||
|
||||
Annotations annotations = httpRequestToBeSent.annotations();
|
||||
|
||||
httpRequest.set(httpRequestToBeSent);
|
||||
|
||||
host = StringProcessor.getHostByUrl(httpRequestToBeSent.url());
|
||||
|
||||
List<String> suffixList = Arrays.asList(Config.suffix.split("\\|"));
|
||||
matches.set(suffixList.contains(httpRequestToBeSent.fileExtension()));
|
||||
|
||||
if (!matches.get()) {
|
||||
List<Map<String, String>> result = messageProcessor.processRequest(host, httpRequestToBeSent, true);
|
||||
setColorAndCommentList(result);
|
||||
}
|
||||
|
||||
return RequestToBeSentAction.continueWith(httpRequestToBeSent, annotations);
|
||||
}
|
||||
|
||||
@Override
|
||||
public ResponseReceivedAction handleHttpResponseReceived(HttpResponseReceived httpResponseReceived) {
|
||||
Annotations annotations = httpResponseReceived.annotations();
|
||||
|
||||
if (!matches.get()) {
|
||||
List<Map<String, String>> result = messageProcessor.processResponse(host, httpResponseReceived, true);
|
||||
setColorAndCommentList(result);
|
||||
// 设置高亮颜色和注释
|
||||
if (!colorList.get().isEmpty() && !commentList.get().isEmpty()) {
|
||||
String color = messageProcessor.retrieveFinalColor(messageProcessor.retrieveColorIndices(colorList.get()));
|
||||
annotations.setHighlightColor(HighlightColor.highlightColor(color));
|
||||
String comment = StringProcessor.mergeComment(String.join(", ", commentList.get()));
|
||||
annotations.setNotes(comment);
|
||||
|
||||
HttpRequestResponse httpRequestResponse = HttpRequestResponse.httpRequestResponse(httpRequest.get(), httpResponseReceived);
|
||||
|
||||
// 添加到Databoard
|
||||
messageTableModel.add(httpRequestResponse, comment, color);
|
||||
}
|
||||
}
|
||||
|
||||
return ResponseReceivedAction.continueWith(httpResponseReceived, annotations);
|
||||
}
|
||||
|
||||
private void setColorAndCommentList(List<Map<String, String>> result) {
|
||||
if (result != null && !result.isEmpty() && result.size() > 0) {
|
||||
colorList.get().add(result.get(0).get("color"));
|
||||
commentList.get().add(result.get(1).get("comment"));
|
||||
}
|
||||
}
|
||||
}
|
||||
172
src/main/java/hae/instances/http/utils/MessageProcessor.java
Normal file
172
src/main/java/hae/instances/http/utils/MessageProcessor.java
Normal file
@@ -0,0 +1,172 @@
|
||||
package hae.instances.http.utils;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.http.message.HttpHeader;
|
||||
import burp.api.montoya.http.message.requests.HttpRequest;
|
||||
import burp.api.montoya.http.message.responses.HttpResponse;
|
||||
import hae.Config;
|
||||
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.util.*;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
|
||||
public class MessageProcessor {
|
||||
private final MontoyaApi api;
|
||||
private final RegularMatcher regularMatcher;
|
||||
|
||||
private String finalColor = "";
|
||||
|
||||
public MessageProcessor(MontoyaApi api) {
|
||||
this.api = api;
|
||||
this.regularMatcher = new RegularMatcher(api);
|
||||
}
|
||||
|
||||
public List<Map<String, String>> processMessage(String host, String message, boolean flag) {
|
||||
Map<String, Map<String, Object>> obj = null;
|
||||
try {
|
||||
obj = regularMatcher.match(host, "any", message, message, message);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
return getDataList(obj, flag);
|
||||
}
|
||||
|
||||
public List<Map<String, String>> processResponse(String host, HttpResponse httpResponse, boolean flag) {
|
||||
Map<String, Map<String, Object>> obj = null;
|
||||
try {
|
||||
String response = new String(httpResponse.toByteArray().getBytes(), StandardCharsets.UTF_8);
|
||||
String body = new String(httpResponse.body().getBytes(), StandardCharsets.UTF_8);
|
||||
String header = httpResponse.headers().stream()
|
||||
.map(HttpHeader::toString)
|
||||
.collect(Collectors.joining("\n"));
|
||||
|
||||
obj = regularMatcher.match(host, "response", response, header, body);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
return getDataList(obj, flag);
|
||||
}
|
||||
|
||||
public List<Map<String, String>> processRequest(String host, HttpRequest httpRequest, boolean flag) {
|
||||
Map<String, Map<String, Object>> obj = null;
|
||||
|
||||
try {
|
||||
String request = new String(httpRequest.toByteArray().getBytes(), StandardCharsets.UTF_8);
|
||||
String body = new String(httpRequest.body().getBytes(), StandardCharsets.UTF_8);
|
||||
String header = httpRequest.headers().stream()
|
||||
.map(HttpHeader::toString)
|
||||
.collect(Collectors.joining("\n"));
|
||||
obj = regularMatcher.match(host, "request", request, header, body);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
return getDataList(obj, flag);
|
||||
}
|
||||
|
||||
private List<Map<String, String>> getDataList(Map<String, Map<String, Object>> obj, boolean actionFlag) {
|
||||
List<Map<String, String>> highlightList = new ArrayList<>();
|
||||
List<Map<String, String>> extractList = new ArrayList<>();
|
||||
|
||||
if (obj != null && !obj.isEmpty() && obj.size() > 0) {
|
||||
if (actionFlag) {
|
||||
List<List<String>> resultList = extractColorsAndComments(obj);
|
||||
List<String> colorList = resultList.get(0);
|
||||
List<String> commentList = resultList.get(1);
|
||||
if (!colorList.isEmpty() && !commentList.isEmpty()) {
|
||||
String color = retrieveFinalColor(retrieveColorIndices(colorList));
|
||||
Map<String, String> colorMap = new HashMap<String, String>() {{
|
||||
put("color", color);
|
||||
}};
|
||||
Map<String, String> commentMap = new HashMap<String, String>() {{
|
||||
put("comment", String.join(", ", commentList));
|
||||
}};
|
||||
highlightList.add(colorMap);
|
||||
highlightList.add(commentMap);
|
||||
}
|
||||
} else {
|
||||
extractList.add(extractDataFromMap(obj));
|
||||
}
|
||||
}
|
||||
|
||||
return actionFlag ? highlightList : extractList;
|
||||
}
|
||||
|
||||
private Map<String, String> extractDataFromMap(Map<String, Map<String, Object>> inputData) {
|
||||
Map<String, String> extractedData = new HashMap<>();
|
||||
inputData.keySet().forEach(key -> {
|
||||
Map<String, Object> tempMap = inputData.get(key);
|
||||
String data = tempMap.get("data").toString();
|
||||
extractedData.put(key, data);
|
||||
});
|
||||
return extractedData;
|
||||
}
|
||||
|
||||
private List<List<String>> extractColorsAndComments(Map<String, Map<String, Object>> inputData) {
|
||||
List<String> colorList = new ArrayList<>();
|
||||
List<String> commentList = new ArrayList<>();
|
||||
inputData.keySet().forEach(key -> {
|
||||
Map<String, Object> tempMap = inputData.get(key);
|
||||
String color = tempMap.get("color").toString();
|
||||
colorList.add(color);
|
||||
commentList.add(key);
|
||||
});
|
||||
List<List<String>> result = new ArrayList<>();
|
||||
result.add(colorList);
|
||||
result.add(commentList);
|
||||
return result;
|
||||
}
|
||||
|
||||
public List<Integer> retrieveColorIndices(List<String> colors){
|
||||
List<Integer> indices = new ArrayList<>();
|
||||
String[] colorArray = Config.color;
|
||||
int size = colorArray.length;
|
||||
|
||||
for (String color : colors) {
|
||||
for (int i = 0; i < size; i++) {
|
||||
if (colorArray[i].equals(color)) {
|
||||
indices.add(i);
|
||||
}
|
||||
}
|
||||
}
|
||||
return indices;
|
||||
}
|
||||
|
||||
private void upgradeColors(List<Integer> colorList) {
|
||||
int colorSize = colorList.size();
|
||||
String[] colorArray = Config.color;
|
||||
colorList.sort(Comparator.comparingInt(Integer::intValue));
|
||||
int i = 0;
|
||||
List<Integer> stack = new ArrayList<>();
|
||||
while (i < colorSize) {
|
||||
if (stack.isEmpty()) {
|
||||
stack.add(colorList.get(i));
|
||||
} else {
|
||||
if (!Objects.equals(colorList.get(i), stack.stream().reduce((first, second) -> second).orElse(99999999))) {
|
||||
stack.add(colorList.get(i));
|
||||
} else {
|
||||
stack.set(stack.size() - 1, stack.get(stack.size() - 1) - 1);
|
||||
}
|
||||
}
|
||||
i++;
|
||||
}
|
||||
// 利用HashSet删除重复元素
|
||||
HashSet tmpList = new HashSet(stack);
|
||||
if (stack.size() == tmpList.size()) {
|
||||
stack.sort(Comparator.comparingInt(Integer::intValue));
|
||||
if(stack.get(0) < 0) {
|
||||
finalColor = colorArray[0];
|
||||
} else {
|
||||
finalColor = colorArray[stack.get(0)];
|
||||
}
|
||||
} else {
|
||||
upgradeColors(stack);
|
||||
}
|
||||
}
|
||||
|
||||
public String retrieveFinalColor(List<Integer> colorList) {
|
||||
upgradeColors(colorList);
|
||||
return finalColor;
|
||||
}
|
||||
|
||||
}
|
||||
274
src/main/java/hae/instances/http/utils/RegularMatcher.java
Normal file
274
src/main/java/hae/instances/http/utils/RegularMatcher.java
Normal file
@@ -0,0 +1,274 @@
|
||||
package hae.instances.http.utils;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import dk.brics.automaton.Automaton;
|
||||
import dk.brics.automaton.AutomatonMatcher;
|
||||
import dk.brics.automaton.RegExp;
|
||||
import dk.brics.automaton.RunAutomaton;
|
||||
import hae.Config;
|
||||
import hae.cache.CachePool;
|
||||
import hae.utils.string.HashCalculator;
|
||||
import hae.utils.string.StringProcessor;
|
||||
import jregex.Matcher;
|
||||
import jregex.Pattern;
|
||||
|
||||
import java.text.MessageFormat;
|
||||
import java.util.*;
|
||||
import java.util.concurrent.ConcurrentHashMap;
|
||||
|
||||
public class RegularMatcher {
|
||||
private final MontoyaApi api;
|
||||
|
||||
public RegularMatcher(MontoyaApi api) {
|
||||
this.api = api;
|
||||
|
||||
}
|
||||
|
||||
public Map<String, Map<String, Object>> match(String host, String type, String message, String header, String body) {
|
||||
// 先从缓存池里判断是否有已经匹配好的结果
|
||||
String messageIndex = HashCalculator.calculateHash(message.getBytes());
|
||||
Map<String, Map<String, Object>> map = CachePool.getFromCache(messageIndex);
|
||||
if (map != null) {
|
||||
return map;
|
||||
} else {
|
||||
// 最终返回的结果
|
||||
Map<String, Map<String, Object>> finalMap = new HashMap<>();
|
||||
Config.globalRules.keySet().parallelStream().forEach(i -> {
|
||||
for (Object[] objects : Config.globalRules.get(i)) {
|
||||
// 多线程执行，一定程度上减少阻塞现象
|
||||
String matchContent = "";
|
||||
// 遍历获取规则
|
||||
List<String> result = new ArrayList<>();
|
||||
Map<String, Object> tmpMap = new HashMap<>();
|
||||
|
||||
boolean loaded = (Boolean) objects[0];
|
||||
String name = objects[1].toString();
|
||||
String f_regex = objects[2].toString();
|
||||
String s_regex = objects[3].toString();
|
||||
String format = objects[4].toString();
|
||||
String color = objects[5].toString();
|
||||
String scope = objects[6].toString();
|
||||
String engine = objects[7].toString();
|
||||
boolean sensitive = (Boolean) objects[8];
|
||||
|
||||
// 判断规则是否开启与作用域
|
||||
if (loaded && (scope.contains(type) || scope.contains("any") || type.equals("any"))) {
|
||||
switch (scope) {
|
||||
case "any":
|
||||
case "request":
|
||||
case "response":
|
||||
matchContent = message;
|
||||
break;
|
||||
case "any header":
|
||||
case "request header":
|
||||
case "response header":
|
||||
matchContent = header;
|
||||
break;
|
||||
case "any body":
|
||||
case "request body":
|
||||
case "response body":
|
||||
matchContent = body;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
try {
|
||||
result.addAll(matchByRegex(f_regex, s_regex, matchContent, format, engine, sensitive));
|
||||
} catch (Exception e) {
|
||||
api.logging().logToError(String.format("[x] Error Info:\nName: %s\nRegex: %s", name, f_regex));
|
||||
continue;
|
||||
}
|
||||
|
||||
// 去除重复内容
|
||||
HashSet tmpList = new HashSet(result);
|
||||
result.clear();
|
||||
result.addAll(tmpList);
|
||||
|
||||
String nameAndSize = String.format("%s (%s)", name, result.size());
|
||||
if (!result.isEmpty()) {
|
||||
tmpMap.put("color", color);
|
||||
String dataStr = String.join("\n", result);
|
||||
tmpMap.put("data", dataStr);
|
||||
finalMap.put(nameAndSize, tmpMap);
|
||||
// 添加到全局变量中，便于Databoard检索
|
||||
if (!Objects.equals(host, "") && host != null) {
|
||||
List<String> dataList = Arrays.asList(dataStr.split("\n"));
|
||||
if (Config.globalDataMap.containsKey(host)) {
|
||||
ConcurrentHashMap<String, List<String>> gRuleMap = new ConcurrentHashMap<>(Config.globalDataMap.get(host));
|
||||
if (gRuleMap.containsKey(name)) {
|
||||
// gDataList为不可变列表，因此需要重新创建一个列表以便于使用addAll方法
|
||||
List<String> gDataList = gRuleMap.get(name);
|
||||
List<String> newDataList = new ArrayList<>(gDataList);
|
||||
newDataList.addAll(dataList);
|
||||
newDataList = new ArrayList<>(new HashSet<>(newDataList));
|
||||
gRuleMap.remove(name);
|
||||
gRuleMap.put(name, newDataList);
|
||||
} else {
|
||||
gRuleMap.put(name, dataList);
|
||||
}
|
||||
Config.globalDataMap.remove(host);
|
||||
Config.globalDataMap.put(host, gRuleMap);
|
||||
} else {
|
||||
Map<String, List<String>> ruleMap = new HashMap<>();
|
||||
ruleMap.put(name, dataList);
|
||||
// 添加单一Host
|
||||
Config.globalDataMap.put(host, ruleMap);
|
||||
}
|
||||
|
||||
String[] splitHost = host.split("\\.");
|
||||
String onlyHost = host.split(":")[0];
|
||||
|
||||
String anyHost = (splitHost.length > 2 && !onlyHost.matches("\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b")) ? StringProcessor.replaceFirstOccurrence(onlyHost, splitHost[0], "*") : "";
|
||||
|
||||
if (!Config.globalDataMap.containsKey(anyHost) && anyHost.length() > 0) {
|
||||
// 添加通配符Host，实际数据从查询哪里将所有数据提取
|
||||
Config.globalDataMap.put(anyHost, new HashMap<>());
|
||||
}
|
||||
|
||||
if (!Config.globalDataMap.containsKey("*")) {
|
||||
// 添加通配符全匹配，同上
|
||||
Config.globalDataMap.put("*", new HashMap<>());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
CachePool.addToCache(messageIndex, finalMap);
|
||||
return finalMap;
|
||||
}
|
||||
}
|
||||
|
||||
private List<String> matchByRegex(String f_regex, String s_regex, String content, String format, String engine, boolean sensitive) {
|
||||
List<String> retList = new ArrayList<>();
|
||||
if ("nfa".equals(engine)) {
|
||||
Matcher matcher = createPatternMatcher(f_regex, content, sensitive);
|
||||
retList.addAll(extractMatches(s_regex, format, sensitive, matcher));
|
||||
} else {
|
||||
// DFA不支持格式化输出，因此不关注format
|
||||
String newContent = content;
|
||||
String newFirstRegex = f_regex;
|
||||
if (!sensitive) {
|
||||
newContent = content.toLowerCase();
|
||||
newFirstRegex = f_regex.toLowerCase();
|
||||
}
|
||||
AutomatonMatcher autoMatcher = createAutomatonMatcher(newFirstRegex, newContent);
|
||||
retList.addAll(extractMatches(s_regex, autoMatcher, content));
|
||||
}
|
||||
return retList;
|
||||
}
|
||||
|
||||
private List<String> extractMatches(String s_regex, String format, boolean sensitive, Matcher matcher) {
|
||||
List<String> matches = new ArrayList<>();
|
||||
if (s_regex.isEmpty()) {
|
||||
matches.addAll(getFormatString(matcher, format));
|
||||
} else {
|
||||
while (matcher.find()) {
|
||||
String matchContent = matcher.group(1);
|
||||
if (!matchContent.isEmpty()) {
|
||||
matcher = createPatternMatcher(s_regex, matchContent, sensitive);
|
||||
matches.addAll(getFormatString(matcher, format));
|
||||
}
|
||||
}
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
private List<String> extractMatches(String s_regex, AutomatonMatcher autoMatcher, String content) {
|
||||
List<String> matches = new ArrayList<>();
|
||||
if (s_regex.isEmpty()) {
|
||||
matches.addAll(getFormatString(autoMatcher, content));
|
||||
} else {
|
||||
while (autoMatcher.find()) {
|
||||
String s = autoMatcher.group();
|
||||
if (!s.isEmpty()) {
|
||||
autoMatcher = createAutomatonMatcher(s_regex, getSubString(content, s));
|
||||
matches.addAll(getFormatString(autoMatcher, content));
|
||||
}
|
||||
}
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
private List<String> getFormatString(Matcher matcher, String format) {
|
||||
List<Integer> indexList = parseIndexesFromString(format);
|
||||
List<String> stringList = new ArrayList<>();
|
||||
|
||||
while (matcher.find()) {
|
||||
if (!matcher.group(1).isEmpty()) {
|
||||
Object[] params = indexList.stream().map(i -> {
|
||||
if (!matcher.group(i+1).isEmpty()) {
|
||||
return matcher.group(i+1);
|
||||
}
|
||||
return "";
|
||||
}).toArray();
|
||||
|
||||
stringList.add(MessageFormat.format(reorderIndex(format), params));
|
||||
}
|
||||
}
|
||||
|
||||
return stringList;
|
||||
}
|
||||
|
||||
private List<String> getFormatString(AutomatonMatcher matcher, String content) {
|
||||
List<String> stringList = new ArrayList<>();
|
||||
|
||||
while (matcher.find()) {
|
||||
String s = matcher.group(0);
|
||||
if (!s.isEmpty()) {
|
||||
stringList.add(getSubString(content, s));
|
||||
}
|
||||
}
|
||||
|
||||
return stringList;
|
||||
}
|
||||
|
||||
private Matcher createPatternMatcher(String regex, String content, boolean sensitive) {
|
||||
Pattern pattern = (sensitive) ? new Pattern(regex) : new Pattern(regex, Pattern.IGNORE_CASE);
|
||||
return pattern.matcher(content);
|
||||
}
|
||||
|
||||
private AutomatonMatcher createAutomatonMatcher(String regex, String content) {
|
||||
RegExp regexp = new RegExp(regex);
|
||||
Automaton auto = regexp.toAutomaton();
|
||||
RunAutomaton runAuto = new RunAutomaton(auto, true);
|
||||
return runAuto.newMatcher(content);
|
||||
}
|
||||
|
||||
private LinkedList<Integer> parseIndexesFromString(String input) {
|
||||
LinkedList<Integer> indexes = new LinkedList<>();
|
||||
Pattern pattern = new Pattern("\\{(\\d+)}");
|
||||
Matcher matcher = pattern.matcher(input);
|
||||
|
||||
while (matcher.find()) {
|
||||
String index = matcher.group(1);
|
||||
if (!index.isEmpty()) {
|
||||
indexes.add(Integer.valueOf(index));
|
||||
}
|
||||
}
|
||||
|
||||
return indexes;
|
||||
}
|
||||
|
||||
private String getSubString(String content, String s) {
|
||||
byte[] contentByte = api.utilities().byteUtils().convertFromString(content);
|
||||
byte[] sByte = api.utilities().byteUtils().convertFromString(s);
|
||||
int startIndex = api.utilities().byteUtils().indexOf(contentByte, sByte, false, 1, contentByte.length);
|
||||
int endIndex = startIndex + s.length();
|
||||
return content.substring(startIndex, endIndex);
|
||||
}
|
||||
|
||||
private String reorderIndex(String format) {
|
||||
Pattern pattern = new Pattern("\\{(\\d+)}");
|
||||
Matcher matcher = pattern.matcher(format);
|
||||
int count = 0;
|
||||
while (matcher.find()) {
|
||||
String newStr = String.format("{%s}", count);
|
||||
String matchStr = matcher.group(0);
|
||||
format = format.replace(matchStr, newStr);
|
||||
count++;
|
||||
}
|
||||
return format;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
package hae.instances.websocket;
|
||||
|
||||
import burp.api.montoya.MontoyaApi;
|
||||
import burp.api.montoya.core.HighlightColor;
|
||||
import burp.api.montoya.proxy.websocket.*;
|
||||
import hae.instances.http.utils.MessageProcessor;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class WebSocketMessageHandler implements ProxyMessageHandler {
|
||||
private final MontoyaApi api;
|
||||
private final MessageProcessor messageProcessor;
|
||||
|
||||
public WebSocketMessageHandler(MontoyaApi api) {
|
||||
this.api = api;
|
||||
this.messageProcessor = new MessageProcessor(api);
|
||||
}
|
||||
|
||||
@Override
|
||||
public TextMessageReceivedAction handleTextMessageReceived(InterceptedTextMessage interceptedTextMessage) {
|
||||
String message = interceptedTextMessage.payload();
|
||||
List<Map<String, String>> result = messageProcessor.processMessage("", message, true);
|
||||
|
||||
if (result != null && !result.isEmpty() && result.size() > 0) {
|
||||
interceptedTextMessage.annotations().setHighlightColor(HighlightColor.highlightColor(result.get(0).get("color")));
|
||||
interceptedTextMessage.annotations().setNotes(result.get(1).get("comment"));
|
||||
}
|
||||
|
||||
return TextMessageReceivedAction.continueWith(interceptedTextMessage);
|
||||
}
|
||||
|
||||
@Override
|
||||
public TextMessageToBeSentAction handleTextMessageToBeSent(InterceptedTextMessage interceptedTextMessage) {
|
||||
return TextMessageToBeSentAction.continueWith(interceptedTextMessage);
|
||||
}
|
||||
|
||||
@Override
|
||||
public BinaryMessageReceivedAction handleBinaryMessageReceived(InterceptedBinaryMessage interceptedBinaryMessage) {
|
||||
return BinaryMessageReceivedAction.continueWith(interceptedBinaryMessage);
|
||||
}
|
||||
|
||||
@Override
|
||||
public BinaryMessageToBeSentAction handleBinaryMessageToBeSent(InterceptedBinaryMessage interceptedBinaryMessage) {
|
||||
return BinaryMessageToBeSentAction.continueWith(interceptedBinaryMessage);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user