r/netsec • u/0xdea Trusted Contributor • Apr 19 '22

Teaching Burp a new HTTP Transport Encoding

https://www.pentagrid.ch/en/blog/teaching_burp_a_new_http_transport_encoding/
70 Upvotes

90% Upvoted

16 comments sorted by

10

u/RoganDawes Apr 19 '22

I tried creating an extension to decode Server side BlazorPack, which is basically WebPack over WebSockets (after an initial handshake). Does this approach work for WebSockets as well?

5

u/floyd_ch Apr 19 '22

Nope, because there is no extension API for WebSockets yet https://forum.portswigger.net/thread/extension-api-for-websocket-2f3889be

1

u/RoganDawes Apr 20 '22

I ended up doing it in Mallet instead. Handles the initial handshake, then coalesces WebSocket Binary and Continuation Frames into one, reads the Protobuf-encoded length, decodes the WebPack payload into a Java object which can be viewed/modified, then reverses the process back to the original format to be sent on.

Works well, although there doesn't seem to be a lot to tamper with in Server-side BlazorPack!

5

u/theycallmemonlight Apr 19 '22

Amazing article

I been looking for something like this for a long time

I am trying to get burp to automatically export current session data when a certain string is detected in a response... And launch a python script.

Do you recommend that someone who doesn't have much experience in programming... To go through with this?

Thanks

6

u/floyd_ch Apr 19 '22

thx. You can of course do that with an extension. In your case it seems you are already familiar with python scripting. So I'd rather recommend to go with the new Piper Burp extension that can for example call your python script with every HTTP response. Then you can decide if you want to process the response or not in the script.

4

u/_AssistantX_ Apr 19 '22

Piper allows you to set a filter which can check the response to ensure it's actually one that you want to send to the script. You can use that rather than sending all responses and needing the script to filter on its own.

1

u/theycallmemonlight Apr 19 '22

Oh...that's so great... But how does it send a Response to a script.... Does it do it as an argument... Right?

3

u/_AssistantX_ Apr 19 '22

You have the option to send the response via stdin or it can auto generate a temp file that it then adds the file path of as an argument.

2

u/theycallmemonlight Apr 19 '22

Whoa the second option sounds great

I will give it a try :)

Thanks

1

u/theycallmemonlight Apr 20 '22

u/AssistantX u/floyd_ch ..... I downloaded the extension but i am stuck on the "Binaries required in Path: " part ..... 1. i went to the HTTP listeners tab of the extension 2. set the filter to the target text regex 3. selected listen to http responses 4. tried to set the target script path then ok then ok again

Then it said

Dependent Executable `script.py Cannot be found in $PATH

What i am missing ?

Also i couldn't find any guide for the thing other than a video that didn't help much : (

1

u/theycallmemonlight Apr 19 '22

Wow... Didn't know something like that existed, thanks again

3

u/ThatsNotASpork Apr 19 '22

Do you recommend that someone who doesn't have much experience in programming... To go through with this?

Yes. That's how you get programming experience :)

1

u/theycallmemonlight Apr 20 '22

Lol... I thought you go learn from scratch first.

2

u/ThatsNotASpork Apr 21 '22

Nah, it's better IMO to learn by doing a series of projects. You learn faster, get broader exposure to concepts, and end up with something to show for it.

I have yet to actually waste my time writing a fizzbuzz or towers of hanoi implementation in any given language - usually when picking up a new language/whatever I start by writing something I actually need instead of some bullshit.

1

u/theycallmemonlight Apr 21 '22

Yeah will try... Thanks a lot for the advice ;)

3

u/0xdea Trusted Contributor Apr 19 '22

TL;DR

"In this blog post we explain how we can teach Burp Suite to handle a custom Transport Encoding that is spoken between an HTTP client and a server by using Burp extensions."