Burp Extension Development Part 2: Data Persistence

Key Takeaways

hello and welcome everyone tiberious here with part two of our series creating burp speed extensions using the new Montoya API if you somehow missed part one no worries you can find the link in the video description I highly recommend checking it out before continuing in the first video we set up our development environment and built a simple extension that slapped a fresh new header onto outgoing requests today we're going to tidy up our extension code by separating the header functionality into a different fun file we'll also change how the header value is calculated and store it so it doesn't get lost when the extension or even burp Suite itself is restarted as always if you think up a cool idea for the extension please share it in the comments and I'll do my best to code up the most popular ones in future videos if you enjoy the content please consider giving the video a like and of course subscribing to the channel as cyber threats grow so does the need for skilled professionals TCM security certifications are here to elevate your skills to meet these challenges our courses are tailored to give you an edge with practical scenario based exams step into the world of advanced cyber security at certifications dotcms sec.com and make your mark to get started ensure you've upgraded burp to at least version 20231 10.2.4 which is the latest available on Cali as of this video this will allow you to access the Montoya API features we'll be using this episode in the last video we created an extension in a single file called my first extension while a single file is technically fine for small extensions it's better to organize your code as it grows let's begin by moving the HTTP header functionality into a separate file open up source and right click on the Java folder create a new Java class called my first HTTP Handler in this class specify that we want to implement the HTTP Handler interface make sure to select the montier version of the interface when prompted which will add the correct import statement for you you'll notice a red error line and that's because we haven't implemented all the methods of the interface yet if you recall last time we right-clicked and used the show context actions helper to add these this time since we already have the code for them we can simply cut and paste this code from the my first extension class now that our my first HTTP Handler class is valid we need to remove the implements HTTP Handler from the my first extension class definition you might notice that with this removed the associated import statement has turned gray this shows us that it is currently not being used by the class nothing bad will happen if we leave the statement in but we might as well remove it since we don't plan on using it here also you should see an error with the registration of the HTTP Handler which is because we are trying to register an instance of the current class using the this keyword since the class no longer implements HTTP Handler this won't work instead we need to create a new instance of the my first HTTP Handler class create a new variable of type my first HTTP Handler called Handler then use the new keyword followed by the class name with a pair of parentheses after it replace the this keyword in the register HTTP Handler method call with the Handler variable to create an instance of a class we need to define a Constructor let's create a simple Constructor for the my first HTTP Handler class this Constructor is minimal but is all we need for now after this recompile the extension and reload it in burp to ensure everything still works now let's add some additional functionality to our Handler instead of adding a header with the same value to each request we'll extract data from the previous response to calculate the value for the next request we'll use the age and date headers concatenate them and hash them using sh 256 to generate the next request header value in our my first HTTP Handler class create a string instance variable called hash to keep track of the latest value this will be accessible by every method in an instance of the class instance variables are usually defined right above the Constructor generally instance variables are given the private keyword meaning they cannot be accessed by other classes while we don't have to give the variable a value by doing so we ensure that it will have one when an instance of the class is created now we can modify the handle HTTP response received method which we we previously left alone since we aren't modifying the response we can keep the return null statement as is instead we're just going to use this method to extract the age and date header values calculate the hash and store it in the instance variable first let's create a local string variable input to store the header values before we hash them we want to set this variable to an empty string so so it has at least some value we can hash just in case a response doesn't have the age and date headers next we want to check if the age header exists within the response and append it to the input string if it does the method argument HTTP response received contains information about the response and we can use its has header method to check if a specific header exists to append to a string variable we can use the plus equals operator and to get the head of value we can use the aptly named header Value method we can copy this block of code and change both instances of age to date extracting the date header value to handle the hash calculation create a sh 256 instance of the message digest class a red error line appears because the get instance method can potentially fail if the string we gave it does not match a known hashing algorithm to prevent our code from not functioning correctly or even crashing the program Java needs us to put in some error catching code rightclick the error and select surround with TR catch a tri catch is a set of code blocks within the try curly braces we put all the code which could potentially fail then the catch block parentheses contains an exception instance followed by a set of curly braces containing code which we want to run if a failure occurs in this case the exception which may occur is a no such algorithm exception many exceptions in Java are named descriptively which helps developers understand what they are and why they might occur note that a TR catch may have multiple catch blocks one for each possible exception alternatively you can technically create a catch all block of sorts by changing the exception class to just exception however this is considered bad practice and is not recommended for now we can leave the catch block code alone since the sh 256 algorithm will almost certainly exist in Java for many years to come there is a near zero chance of the No Such algorithm exception being thrown unless you have mistyped the algorithm since the code we want to write is all related to the message digest we can put it all in the tri block we need to update the digest with the input data we can see from the helper menu that all four possible update methods take some form of BTE input this one takes a simple byte array as denoted by the square brackets next to the type luckily string objects have a get byes method we can use to generate a bite array of the string character values note that this method requires us to provide a Char set we can assume everything will be in utf8 note that there is now a red error line and a yellow warning line the error occurs for the same reason it did when we provided the sh 256 string it's possible that the utf8 value we gave isn't a real Char set we could add another catch block for this exception but there's a nicer way to solve this if we hover over the yellow warning intellig will tell us that instead of providing a string directly we can use the standard charsets class if we click replace with standard Char sets. utf8 we can see that both the warning and error message disappear we can now generate the hash or digest by calling the digest method note that this method returns a a BTE array the standard way to display hashes is with a hex string I.E converting each BTE to hexad decimal and concatenating them together luckily there is a standard class in Java called hex format which allows us to easily generate hex strings from a bite array we want to store this hex string in the hash variable we created since we're in a class method we can use the this key ke word to reference the current instance of the class then a period followed by hash to reference the hash variable now an equal sign to assign something to this variable finally we can reference the hex format class add a period and choose the of method with the format hex method after it the off method just sets up the formatter so it will produce a string comprised of all lowercase characters and no delimiter the format hex method takes a bite array as an argument within the parentheses use the digest variable again and call the digest method so it Returns the required bite array if you're ever wondering what various class methods do you can find detailed information in the official Java documentation simply search for the class name EG hex format or even the method name and choose the matching result there should be a detailed description of the class common code excerpts and a full list of the methods clicking on one of the methods will bring you to a full description of it now let's change the handle HTTP request to be sent method to use the calculated hash instead of the static value to avoid adding the header if the hash is empty use an if statement and the is empty method negate it using an exclamation point to make sure the header will only be added if the string is not empty let's change the header name to x- and the value to this do has finally note that there is now a red error line at the end of the method if we hover over this we see that intell says there is a missing return statement even though we have a return statement here it will only be executed if the hash value is not empty we need a return statement for when this is not the case luckily we can simply add a return null at after the if statement closes although this might look like we're returning a value twice we are not once any return statement is reached none of the remaining code in the method is executed keep this in mind when developing code let's rebuild the extension and reload it in burp Suite we'll visit example.com again then we will refresh the page back in burps logger we can see the first request did not have the additional header but the second request did as will every subsequent request there's one issue left when the extension is reloaded or burp is restarted the calculated hash is is lost to address this let's add the ability to automatically save and restore the most recent hash value create a new Java class called unloading Handler and implement the extension unloading Handler interface as we've done before get intellig to resolve the error by implementing The Missing Method in the unloading Handler class we'll save the latest hash value when the extension is unloaded to do this it will need access to the Montoya API and the my first HTTP Handler instance Define instance variables to store these create a Constructor that takes both instances as arguments note that although the instance variables have the same names as the arguments in the Constructor they are separate entities this will become apparent within the Constructor itself as we need to assign the API argument to the API instance variable and do the same for the Handler although it may look like we're assigning things to themselves we can click on the API variable and see that the argument is highlighted showing it is the same if we click on the this. API we see that the instance variable is highlighted instead if this is too confusing you can easily rename the argument don't do this manually however as it could break your code if you ever want to rename something use intell's rename feature right click the thing you want to rename choose refactor and then rename now we can type whatever we want the new name to be and intellig will automatically update all of our code wherever the old name was referenced in the extension unloaded method use the Montoya API to save the hash value remember to use the this keyword when referencing instance variables here well first reference the API then choose the persistence method then preferences and finally set string since the hash is a string value we need to provide two strings one being a preference name we want to use when saving and the other being the actual saved value let's use hash for the name and then we can reference the Handler instance variable to get the hash value however the hash variable isn't there if we look at the my first HTTP Handler class we can see why we originally set the hash instance variable to private there are two solutions we could Implement here the first is to just make the variable public which would mean our unloading Handler class could access it while this is the simplest solution making instance variables public should be avoided in most cases instead it is best practice to create a public method in the class which Returns the private instance variable this effectively makes it impossible for other classes to change the variable's value directly which is good because we only want the hash to be generated from the headers these methods are known as Getters and they are very simple to implement in the my first HTTP Handler class add the following code below the con structor public makes the method accessible to other classes string is the type which the method returns and get hash is just the name of the method the method does not need any arguments and inside the curly braces we just need to return the hash instance variable back in the unloading Handler we can complete our code by referencing this method now all we need to do is register our new Handler in the my first extension classes initialize method remember that we need to provide our new unloading Handler instance with the Montoya API and my first HTTP Handler instances now when the extension is unloaded it will save the hash value to restore it when the the extension is loaded modify the initialize method to check for the existence of the hash value in the extension preferences first let's create a local string variable called hash and set it to an empty string next we need an if statement where we access the API persistence preferences and then the string Keys method which returns a set of all the key names for string values we can then use the contains method to check if the hash key is present if it is we can set the hash variable to the value by using the get string method when creating a new my first HTTP Handler instance pass the hash variable to the Constructor an error occurs because the my first HTTP Handler class isn't expecting anything to be passed to the Constructor so let's fix that in the class add a string argument to the Constructor then inside the Constructor set the instance variable to this value re build the extension and reload it in burp send a couple of new requests noting that the extension is adding headers next restart burp and send another request the extension has used the hash value it calculated prior to the restart and has added it to this first request in the next video we'll add more features to our extension exploring other parts of the Montoya API as I mentioned at the start if you have any requests for specific features please let me know in the comments I'll upload the code from this video to GitHub and provide all the important links in the video description that's all for now if you enjoyed the video and found it informative please consider giving it a like subscribing to the channel and I'll see you next time