Burp extensions creation #1
Hi guys,
Welcome to this Burp Extension Creation course. I plan to show how to create Burp Suite extensions in a simple way. I have created some extensions and experimented quite a bit and I think I am in a position to teach a thing or two that most tutorials or books don’t teach and that are not so obvious. This course is also a set of notes to my future self which I know I will be coming to again and again since, as you will know when you spend time creating your own extensions, this stuff is not easy to remember and can get a bit complex.
I hope you find this course useful and create cool extensions that allow you to simplify your manual tasks. Before getting your hands dirty and banging your head against the keyboard I advice researching the existing extensions, there are lots of them and probably there is some that already does what you need.
This course will cover Python extensions, but the ideas should be easily translated into Java or Ruby by anyone who knows these languages, since the main ingredients to Burp extensions are:
1- Swing and Awt Java libraries.
2- Burp APIs
Note: Python extensions are in principle slower than Java, but unless you make some weird coding mistakes performance shouldn’t be a big issue at runtime. What I have observed though is that Python extensions load way slower than Java, but anyway, once the extension is finished a few seconds of loading shouldn’t make much of a difference.
This is just the introduction to the course, therefore I will not fill this post with details. Let’s just start by setting up the environment for using Python extensions. First, download the .jar file of Jython from here and save it somewhere in your local drive (you need to do this to use other people’s extensions as well, may it be from extensions you download from the internet or from the BApp store):
https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.3/jython-standalone-2.7.3.jar
(Or check the Jython page and download the latest available version).
Then let BurpSuite know where you placed this .jar file:
After that you can browse extensions on the BApp store tab or add them from your local hard drive in the Extensions tab.
What is Jython? It is an implementation of Python written in Java, unlike the standard Python (aka CPython), which is written in C. Unfortunately Jython is stuck in Python 2 and, although there has been some discussion going on for a while about creating a Jython 3 it seems pretty stuck.
Therefore you cannot expect to create Python extensions using Python 3 idioms and syntax in the near future, and probably never. In any case Python 2 and Python 3 are very similar in practice so it’s not a big deal. The only real problem is if you want to include third party libraries written in Python 3 in your extension. They will likely not work and you will need to find some other way to achieve what that library does.
Get Antonio Lara’s stories in your inbox
Join Medium for free to get updates from this writer.
In any case, this course assumes basic knowledge of Python
Provisional course contents (subject to changes):
- Basic concepts
- Diferences between Jython and CPython
- Burp API
- Helper functions
- Context menu
- New tab/window extension
- Basics of Swing GUIs
- Placing objects in the GUI (Layouts)
- Interacting with Burp Proxy History
- Using tables and advanced table formatting
- HTML formatting in current Burp versions
- Threading
- (More topics to be added in the future…)
So, let’s get started, click on this link to proceed to the next lesson, or just browse through my profile to find the one you are more interested in:
