Extending Burp Suite (DerbyCon 2017)

DerbyCon · Louisville, KY · 2017 · 20 min Player blocked? Watch it on YouTube. Burp is the tool most of us live in for web testing, but a lot of people never touch the Extender tab. This talk was my pitch for changing that: if you keep doing the same check by hand, Burp will let you write it once and have the scanner do it for you. What I covered Where extensions come from. The BApp Store, what the Pro-only flag means, and how to load your own JAR or script through Extender (and where its output and errors show up when it doesn’t work). Language choices. Java, Python through Jython, or Ruby through JRuby. Same API either way. The Extender API. You can read and modify requests and responses, hook into the built-in tools, add your own tabs and context-menu items, and persist settings between sessions. The skeleton. A BurpExtender class implementing IBurpExtender, with registerExtenderCallbacks as the entry point. For scanner work you also implement IScannerCheck: doPassiveScan,…