Package gds :: Package pub :: Package burp :: Module utils
[hide private]
[frames] | no frames]

Module utils

GDS Burp Suite API Utilities

* Burp and Burp Suite are trademarks of PortSwigger Ltd. Copyright 2008 PortSwigger Ltd. All rights reserved. See http://portswigger.net for license terms.

Copyright (c) 2009-2010 Marcin Wielgoszewski <marcinw@gdssecurity.com> Gotham Digital Science

This file is part of GDS Burp API.

GDS Burp API is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

GDS Burp API is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with GDS Burp API. If not, see <http://www.gnu.org/licenses/>

Functions [hide private]
dict
parse_parameters(request)
Parse request parameters in a gds.burp.Burp request/response object.
dict
parse_multipart_form(content, multipart_boundary)
Parses multipart/form-data.
dict
parse_headers(headers)
Parse HTTP headers.
 
safeint(num)
If possible, cast an object of type String, Float, Boolean to an Integer.
 
save_state(filename, parsed_burp_log)
Used to save a parsed Burp Suite log to file that can later be re-loaded.
list
load_state(filename)
Load a previously parsed Burp Suite log.
bool
is_equal(original, supplied)
A byte for byte string comparison function.
Variables [hide private]
  BOUNDARY = re.compile(r'(?i)Content-Disposition: form-data; na...
  FORM_DATA = re.compile(r'(?i)multipart/form-data; boundary=([a...
  KEY = 'gds.burp'
  LOGGER = logging.getLogger(__name__)
  __package__ = 'gds.pub.burp'

Imports: cgi, logging, cPickle, gzip, hashlib, hmac, json, re


Function Details [hide private]

parse_parameters(request)

 

Parse request parameters in a gds.burp.Burp request/response object.

Parameters:
  • request - A gds.burp.Burp request/response object.
Returns: dict
A dict containing parameters and values from query string, body and multipart/form-data.

parse_multipart_form(content, multipart_boundary)

 

Parses multipart/form-data.

This needs more testing, as I'm not sure all browsers make multipart form requests that are in this format.

Parameters:
  • content - The multipart/form-data content from HTTP request.
  • multipart_boundary - The boundary specifier as declared in the HTTP Content-Type: multipart/form-data header.
Returns: dict
A dict containing parameters and values.

parse_headers(headers)

 

Parse HTTP headers.

Parameters:
  • headers - A string of HTTP headers.
Returns: dict
A dict of HTTP headers and values.

safeint(num)

 

If possible, cast an object of type String, Float, Boolean to an Integer. Returns int(num) if successful, else num.

Parameters:
  • num - An arbitrary type to be cast as an int.
Returns:
Attempt to return int(num). Return num if failed.

save_state(filename, parsed_burp_log)

 

Used to save a parsed Burp Suite log to file that can later be re-loaded.

Parameters:
  • parsed_burp_log - A Burp Suite log parsed by gds.burp.log.parse().
  • filename - Name of file to save a parsed Burp Suite log state to.

load_state(filename)

 

Load a previously parsed Burp Suite log.

Due to security concerns regarding the Python Pickle module, this method will only only load pickled objects that were saved using gds.burp.save_state().

Parameters:
  • filename - The filename of the gds.burp state file.
Returns: list
A parsed Burp Suite log.

is_equal(original, supplied)

 

A byte for byte string comparison function. Usually used when comparing two HMAC's, it returns True or False only after the entire string was analyzed (meaning, we don't return False on the first non-match).

If use this for validating passwords, you're doing it wrong.

Parameters:
  • original - The original string to be compared against.
  • supplied - A string supplied by the user.
Returns: bool
True if value of original is equal to value of supplied.

Variables Details [hide private]

BOUNDARY

Value:
re.compile(r'(?i)Content-Disposition: form-data; name="([^"]+)')

FORM_DATA

Value:
re.compile(r'(?i)multipart/form-data; boundary=([a-z0-9-]+)')