Burp Extension Development Part 3 - Singletons & Scope

Key Takeaways

hello and welcome everyone tiberious here and today we are continuing our series creating burps with extensions using the shiny new Montoya API this is part three and if you've missed one of our thrilling previous installments you can find the links in the video description trust me you do not want to miss out on those last time we shuffled some functionality around tweaked how our custom header value was calculated and implemented a Nifty save and restore feature today we're going to keep things relatively simple adding a special object which allows us to make calls to the Montoya API without having to pass an instance of the API around all of the time plus we're going to make sure our custom header only shows up in requests we want it to as always if you have Amazing Ideas you want to see me code please share them in the comments and I'll do my best to bring the most popular ones to life in future videos if you enjoy the content please consider giving the video a like and of course subscribing to the the channel as cyber threats grow so does the need for skilled professionals TCM security certifications are here to elevate your skills to meet these challenges our courses are tailored to give you an edge with practical scenario based exams step into the world of advanced cyber security at certifications dotcms sec.com and make your mark all right let's geek out for a sec and talk about software design patterns these are General reusable solutions to Common problems in software design think of them like tried andrue recipes created by Michelin star software Engineers ever heard of an object pool pattern it's like a recycling center for objects in your code improving performance by reusing objects instead of creating them on demand several web and database servers use object pools to handle connections as the high number of incoming requests can cause performance issues if new connection objects have to be continually created and destroyed you can read more more about software design patterns at will link on the screen and of course in the video description the reason we're talking about them is we are going to use a popular one the Singleton pattern a Singleton is a special type of object which can only ever be created once we don't necessarily need this but it will save us a lot of time when coding an instance of The Monto API is provided to our extension in the initialized method of our my first extension class this is the the only instance of the Montoya API we are ever given so if we need to use it in other classes we currently must pass it to an instance of the Class via a Constructor we did this already when we created the unloading Handler but since the Montoya API instance contains a lot of useful functionality we'll likely need it throughout our extension instead of passing it by our a Constructor each time let's create a new class using the Singleton pattern give that an instance of the Montoya API and then simply use that new class whenever we need to use the API first let's create a new Java class file called M api. Java we add the word final to the class declaration this isn't strictly necessary but for the purposes of following the design pattern we will include it next we add a class variable to store the actual Montoya API instance and we'll call it instance in all caps just to make that clear the static keyword tells Java that the variable belongs to the class rather than an instance of the class for this kind of Singleton we don't actually need any instances of this class to be created since it's more of a wrapper around the Montoya API instance to prevent instances from being created we can simply Define a private Constructor now we need a method we can call when our extension loads to pass our Montoya API instance into the Class via a parameter called API in this method since we only ever want one instance of the Montoya API to be passed we'll create an if statement where the API variable is only assigned to our class variable if the class variable is currently null I.E nothing has been assigned to it yet finally we need a geta method to retrieve the Montoya API instance in the my first extension class in the initialized method we need to make a call to the mapi classes initialized method and pass in the Montoya API instance since we no longer want to pass the Montoya API around via Constructors we can also remove the API reference from the unloading Handler Constructor call here this will cause an error since at the moment the unloading Handler Constructor needs an instance of The Monto API let's fix that by removing the instance variable the Constructor argument and the assignment finally we need to replace the this. API call down here with mapi do get API all good so far let's change our HTTP Handler code so that the header is only applied to and only generated from requests which are considered in the scope our handle HTTP request to be sent method already has a handy if statement surrounding the relevant code so we just need to add another conditional check to it since we only want the code within the if statement braces to run if both our conditionals are true we need to separate them using two ampersound symbols which represents a logical and operation luckily the HTTP request be sent object has a handy is in scope method we can use for this check in the handle HTTP response received method we need to create a new if statement surrounding all the code except for the return null at the end the conditional here is similar though the HTTP response received object does not have an is in scope method instead we can actually access the request which triggered this response via the initiating request method then call is in scope from that finally to show off our amazing API rapper again after the hex format line add a call to the logger by the API and log the hash that has been generated save and rebuild the extension then reload it in burp Suite load example.com and then check the logger in burp note that this time no header was added to the request this is because example.com is not in scope since we haven't added anything to burp scope settings yet let's do that now you can access the scope settings on the target tab I prefer using Advanced modes since it's more flexible click add and then enter example.com in the host field click okay and refresh the example.com page now back in burps logger we can see that the header value is being added again in my next video We'll add more features to our extension exploring other parts of the Montoya API as I mentioned at the St of the video if you have any requests for specific features please let me know in the comments I'll upload the code from this video to GitHub and provide all the important links in the video description that's all for now if you enjoyed the video and found it informative please consider giving it a like subscribing to the channel and I will see you next time