Extending Burp with Jython Burp API
Last year, I released the Jython Burp API,
a plugin framework to Burp that allows running multiple plugins simultaneously,
exposes an interactive Jython console, provides Filter-like
functionality, and eases developing plugins at runtime by providing more
Pythonic APIs and automatic code reloading for when code or configurations
are updated. I presented an overview of my framework at an iSec Partners Forum
in NYC last year. Others have released similar frameworks that also provide the
ability to write Burp extensions in Jython.
Since then, PortSwigger released a new Burp Extender API, allowing users
to develop all sorts of plugins and extend Burp’s various tools in a myriad
of ways. Regardless, I still find my framework and others like Buby still
have their place. I’d like to take the next few paragraphs to guide users
on setting up the Jython Burp API in their environment.
Getting Jython
First, we’ll need to get the latest 2.7+ standalone version of Jython.
At the time of this writing, the latest version is Jython 2.7beta1.
Once you download Jython, configure Burp’s Python Environment.
Loading the Jython Burp API
If you haven’t already done so, download the Jython Burp API. Then, all
you need to do (provided you’re running Burp 1.5.04 or later), is add
jython-burp-api/Lib/burp_extender.py as a Python extension to Burp:
After you’ve clicked next, you should see the extension among the list of other
currently loaded extensions (if any).
An additional feature you may find useful is an interactive Jython console
tab, that allows you to interact with the Burp Extender object and any other
variables in the local namespace. I find it useful to iterate over requests in
Burp’s Proxy History, collecting various information or highlighting/commenting
requests that may contain a specific header or string in the response body.
I added a right-click context menu item so you could select specific requests
and send them to the items variable, accessible from the console.
In a future blog post, I may dive into using some of the other features of
the framework. In the mean time, please feel free to fork and contribute to
the Jython Burp API!
*** This is a Security Bloggers Network syndicated blog from tssci-security authored by Marcin Wielgoszewski. Read the original post at: http://www.tssci-security.com/archives/2013/02/14/extending-burp-with-jython-burp-api
