Module utils
GDS Burp Suite API Utilities
* Burp and Burp Suite are trademarks of PortSwigger Ltd. Copyright
2008 PortSwigger Ltd. All rights reserved. See http://portswigger.net for
license terms.
Copyright (c) 2009-2010 Marcin Wielgoszewski
<marcinw@gdssecurity.com> Gotham Digital Science
This file is part of GDS Burp API.
GDS Burp API is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by the
Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
GDS Burp API is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
Public License for more details.
You should have received a copy of the GNU General Public License
along with GDS Burp API. If not, see
<http://www.gnu.org/licenses/>
dict
|
parse_parameters(request)
Parse request parameters in a gds.burp.Burp request/response object. |
|
|
dict
|
|
dict
|
|
|
safeint(num)
If possible, cast an object of type String, Float, Boolean to an
Integer. |
|
|
|
save_state(filename,
parsed_burp_log)
Used to save a parsed Burp Suite log to file that can later be
re-loaded. |
|
|
list
|
load_state(filename)
Load a previously parsed Burp Suite log. |
|
|
bool
|
is_equal(original,
supplied)
A byte for byte string comparison function. |
|
|
|
BOUNDARY = re.compile(r'(?i) Content-Disposition: form-data; na...
|
|
FORM_DATA = re.compile(r'(?i) multipart/form-data; boundary=( [ a...
|
|
KEY = ' gds.burp '
|
|
LOGGER = logging.getLogger(__name__)
|
|
__package__ = ' gds.pub.burp '
|
Imports:
cgi,
logging,
cPickle,
gzip,
hashlib,
hmac,
json,
re
parse_parameters(request)
|
|
Parse request parameters in a gds.burp.Burp request/response
object.
- Parameters:
request - A gds.burp.Burp request/response object.
- Returns: dict
- A dict containing parameters and values from query string, body
and multipart/form-data.
|
parse_multipart_form(content,
multipart_boundary)
|
|
Parses multipart/form-data.
This needs more testing, as I'm not sure all browsers make multipart
form requests that are in this format.
- Parameters:
content - The multipart/form-data content from HTTP request.
multipart_boundary - The boundary specifier as declared in the HTTP Content-Type:
multipart/form-data header.
- Returns: dict
- A dict containing parameters and values.
|
Parse HTTP headers.
- Parameters:
headers - A string of HTTP headers.
- Returns: dict
- A dict of HTTP headers and values.
|
If possible, cast an object of type String, Float, Boolean to an
Integer. Returns int(num) if successful, else num.
- Parameters:
num - An arbitrary type to be cast as an int.
- Returns:
- Attempt to return int(num). Return num if failed.
|
save_state(filename,
parsed_burp_log)
|
|
Used to save a parsed Burp Suite log to file that can later be
re-loaded.
- Parameters:
parsed_burp_log - A Burp Suite log parsed by gds.burp.log.parse().
filename - Name of file to save a parsed Burp Suite log state to.
|
Load a previously parsed Burp Suite log.
Due to security concerns regarding the Python Pickle module, this
method will only only load pickled objects that were saved using
gds.burp.save_state().
- Parameters:
filename - The filename of the gds.burp state file.
- Returns: list
- A parsed Burp Suite log.
|
is_equal(original,
supplied)
|
|
A byte for byte string comparison function. Usually used when
comparing two HMAC's, it returns True or False only after the entire
string was analyzed (meaning, we don't return False on the first
non-match).
If use this for validating passwords, you're doing it wrong.
- Parameters:
original - The original string to be compared against.
supplied - A string supplied by the user.
- Returns: bool
- True if value of original is equal to value of supplied.
|
BOUNDARY
- Value:
re.compile(r'(?i) Content-Disposition: form-data; name="( [^ "] + ) ')
|
|
FORM_DATA
- Value:
re.compile(r'(?i) multipart/form-data; boundary=( [ a- z0- 9-] + ) ')
|
|