Breaking

Use Python for Burp plugins with pyBurp

One of our favorite tools for conducting penetration tests (especially, but not only, web application tests) is Portswiggers’s Burp Suite. Burp allows to extend its features by writing own plugins. But because Burp is written in Java, it only supports Java classes as plugins. Additionally, Burp only allows to use one plugin at the same time which has to be loaded on start-up.

Now we have written a Burp-Python proxy (called pyBurp) which adds some features to the plugin system:

  • write plugins in Python
  • load and unload plugins at every time
  • load multiple plugins

The only restriction is that one has to use Jython for compiling and interpreting the python  scripts. Actually we have tested it with Jython 2.5.2 (other versions might work, but this is the one we tested).

For setting up and using pyBurp, just follow these steps:
Setup up:

  1. download your desired package of pyBurp (src or binary, you can find the downloadlinks at the end of this post)
  2. download Jython and extract/install (Version 2.5.2 is recommended)
  3. If you want to build from source, you will need a JDK (for compiling) and GNU make installed (for the Makefile only, you need to compile it manually without it)
    1. update the paths in the Makefile for your Burp copy and Jython
    2. run make
  4. update the paths in the burp.sh for your Burp copy and Jython (Linux/Unix startscript)

Start and work with plugins (shown with sample plugin):

  1. start Burp via burp.sh
    • Burp should have told you on which port it waits for load and unload commands (e.g. 55666).
  2. Load a Pythonplugin:
    $ nc localhost 55666            # or some other port reported at startup
    pwd                             # shows you the current workingdir to load from
    /home/foo
    cd /home/foo/sources/pyBurp     # change the current workingdir
    add PoCPlugin                   # load the PoC-Plugin
    adding PoCPlugin
    done
    list                            # show loaded Plugins
    Callback list:
    1: PocPlugin
    quit                            # quit communication
    Bye
    $
  3. Remove a Python plugin:
    $ nc localhost 55666            # or some other port reported at startup
    list                            # show loaded Plugins
    Callback list:
    1: PoCPlugin
    rm 1                            # remove Plugin with no. 1
    removing PoCPlugin
    done
    quit                            # quit communication
    Bye
    $

Possible commands:

Command Syntax Description
add add <plugin name> loads a plugin
list list lists all loaded plugins
rm rm <nr of loaded plugin> unloads a plugin
cd cd <absolute path> change current load path
pwd pwd displays current load path

Downloads:

  • Binary: burp_python.jar
    • SHA1: 500ed30f6473556093f1f388025932c41c262e72
    • MD5: 66526190fe6b4d0b149a2918c14336db
  • Sourcecode: pyBurp.tar.gz
    • SHA1: e3e4deb5f28a49c3e0a9518f7a8d2514c0a30225
    • MD5: 48f62186fcaf927b28f6e1c44e7fad74

 

We hope some of you find pyBurp useful. We’re happy to receive any feedback or bug reports in case you find some 😉

Merry Christmas and a happy new year to everybody

Timo