{"id":13843443,"url":"https://github.com/righettod/burp-piper-custom-scripts","last_synced_at":"2025-07-11T19:31:32.949Z","repository":{"id":50086222,"uuid":"316246695","full_name":"righettod/burp-piper-custom-scripts","owner":"righettod","description":"Custom scripts for the PIPER Burp extensions.","archived":true,"fork":false,"pushed_at":"2023-09-24T06:37:08.000Z","size":1373,"stargazers_count":97,"open_issues_count":1,"forks_count":17,"subscribers_count":9,"default_branch":"main","last_synced_at":"2024-08-05T17:37:27.116Z","etag":null,"topics":["burpsuite","pentesting","piper","web"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/righettod.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2020-11-26T13:57:33.000Z","updated_at":"2024-04-26T11:53:21.000Z","dependencies_parsed_at":"2022-09-18T19:12:05.062Z","dependency_job_id":"2a7860b2-0fcc-4fe0-bad2-d8547047a3b6","html_url":"https://github.com/righettod/burp-piper-custom-scripts","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fburp-piper-custom-scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fburp-piper-custom-scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fburp-piper-custom-scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fburp-piper-custom-scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/righettod","download_url":"https://codeload.github.com/righettod/burp-piper-custom-scripts/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225754987,"owners_count":17519183,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["burpsuite","pentesting","piper","web"],"created_at":"2024-08-04T17:02:08.703Z","updated_at":"2024-11-21T15:30:57.835Z","avatar_url":"https://github.com/righettod.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python"],"sub_categories":[],"readme":"\u003e 🚨 Project was stopped to move to [Burp BCheck](https://portswigger.net/burp/documentation/scanner/bchecks) build-in feature.\n\n![code_static_analysis_and_os_compatibility_tests](https://github.com/righettod/burp-piper-custom-scripts/workflows/code_static_analysis_and_os_compatibility_tests/badge.svg?branch=main)\n\n# Objective\n\nCentralize and share all my custom scripts to be used with the [PIPER](https://portswigger.net/bappstore/e4e0f6c4f0274754917dcb5f4937bb9e) Burp extension.\n\n[Documentation](https://blog.silentsignal.eu/2020/03/27/unix-style-approach-to-web-application-testing/) of the extension.\n\n# Runtime requirements\n\n\u003e :information_source: Reduced to the minimal ones needed, see file [requirements.txt](requirements.txt) for details.\n\nPython \u003e= **3.9** needed and in `PATH`.\n\n```powershell\nPS\u003e python --version\nPython 3.9.7\n```\n\n# Compatibility tests\n\nThis [GitHub action workfow](.github/workflows/static_code_analysis.yml) validate that all scripts are compatible with Python `3.9`, `3.10` on `Windows`, `Mac` and `Linux` OS.\n\n# Embedding of this collection of scripts into the PIPER source repository\n\nThis [topic](https://github.com/silentsignal/burp-piper/issues/8) is pending on the PIPER's author side. Once ready, this repository will be merged.\n\n# IDE\n\n[Visual Studio Code](https://code.visualstudio.com/) with [Python extension provided by Microsoft](https://marketplace.visualstudio.com/items?itemName=ms-python.python) is used to develop the scripts.\n\n[Project workspace file](project.code-workspace) has been configured to trigger the installation of required code analysis modules and analysis profile is defined in the workspace settings area.\n\n[Debug configuration](.vscode/launch.json) was provided to debug a python script.\n\n# Structure\n\nEach script describes its goal in its header, for which PIPER tools is targeted to be used and instruction regarding if HTTP headers must be passed as well as filter to define:\n\n```text\n\"\"\"\nPIPER script to ...\nTarget tool: [PIPER_TOOL]\n[INSTRUCTION_IF_HTTP_HEADERS_MUST_BE_PASSED]\n[FILTER_NEEDED_TO_BE_DEFINED]\n\"\"\"\n```\n\n# Overview of the scripts behavior\n\n## detect-non-standart-headers\n\nAdd a comment to the matching line in the proxy tab for every response containing non-standart HTTP headers.\n\n![detect-non-standart-headers](images/detect-non-standart-headers.png)\n\n## detect-request-to-web-api\n\nHighlight the matching line in the proxy tab for every request that is made to a web api.\n\n![detect-request-to-web-api](images/detect-request-to-web-api.png)\n\n## extract-web-api-endpoints\n\nExtract all API endpoints (*and URL like because it is hard to really identify if a URL is an API endpoint or not from a static point view*) from a JS script content obtained from a HTTP response.\n\n![extract-web-api-endpoints](images/extract-web-api-endpoints.png)\n\n## extract-html-metadatas\n\nExtract interesting information from HTML META tags from a HTTP response. Mainly used to quickly identify which products/tools was used to build the site/application.\n\n![extract-html-metadatas](images/extract-html-metadatas.png)\n\n## detect-response-with-errors-disclosure\n\nDetect HTTP responses containing a strack trace. Mainly used to quickly identify pages disclosing technical information via stack traces.\n\n![detect-response-with-errors-disclosure](images/detect-response-with-errors-disclosure.png)\n\n## extract-jwt-tokens\n\n\u003e :dart: This script was created in order to avoid the need to use another [extensions](https://portswigger.net/bappstore) or the [decoder](https://portswigger.net/burp/documentation/desktop/tools/decoder) to just see the content of the token.\n\nExtract and pretty-display all [JWT](https://jwt.io/introduction) tokens present in an HTTP response.\n\n![extract-jwt-tokens](images/extract-jwt-tokens.png)\n\n## extract-blazor-webassembly-assemblies\n\n\u003e :dart: Just copy/paste the script section in a `ps1` / `sh` file and execute it to retrieve all the assemblies.\n\nExtract the collection of assemblies from a HTTP response describing the assemblies used by a [Blazor WebAssembly](https://blazor-university.com/overview/blazor-hosting-models/) application.\n\nA script to download all the assemblies, is generated in the same time:\n\n* For Windows is PowerShell.\n* For other is Bash.\n\n![extract-blazor-webassembly-assemblies](images/extract-blazor-webassembly-assemblies.png)\n\n## extract-uuid-infos\n\n\u003e :clap: Inspired from this [project](https://github.com/silentsignal/burp-uuid) so, credits goes first to it!\n\nExtract the collection of [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) present in a HTTP response and then, depending on the version of UUID, extract the infos for each of them.\n\n![extract-uuid-infos](images/extract-uuid-infos.png)\n\nSources:\n\n* [How secure are your Universally Unique IDentifiers?](https://versprite.com/blog/universally-unique-identifiers/)\n* [Not so unique snowflakes](https://blog.silentsignal.eu/2017/02/17/not-so-unique-snowflakes/).\n* [UUID versions explained](https://www.uuidtools.com/uuid-versions-explained).\n* [POC \"Sandwich Attack: A New Way Of Brute Forcing UUIDs\"](https://gist.github.com/righettod/45d59e1d8eb83fe351a9e9aafb37f91f).\n\n## extract-spa-unsafe-patterns\n\nExtract all occurences of unsafe patterns used in a [Single Page Application](https://en.wikipedia.org/wiki/Single-page_application) (SPA) main JS bundle file.\n\nThe objective is to quickly spot if framework built-in security features are disabled or if unsafe code patterns are used in order to identify potential attack vectors on the client side.\n\n![extract-spa-unsafe-patterns](images/extract-spa-unsafe-patterns.png)\n\n## extract-spa-low-hanging-fruits\n\nExtract elements from a [Single Page Application](https://en.wikipedia.org/wiki/Single-page_application) (SPA) html files and main JS bundles that can be interesting from security point of view.\n\nThe objective is to quickly spot interesting low-level issues than can used as foundation to discover more critical issues.\n\n![extract-spa-low-hanging-fruits](images/extract-spa-low-hanging-fruits.png)\n\n![extract-spa-low-hanging-fruits](images/extract-spa-low-hanging-fruits2.png)\n\n## extract-saml-response-infos\n\n\u003e :dart: This script was created in order to avoid the need to use another [extensions](https://portswigger.net/bappstore) or the [decoder](https://portswigger.net/burp/documentation/desktop/tools/decoder) to just see the content of the SAML response.\n\nExtract and pretty-display information from a [SAML response](https://auth0.com/blog/how-saml-authentication-works/) present in an HTTP response.\n\n![extract-saml-response-infos](images/extract-saml-response-infos.png)\n\n## extract-saml-request-infos\n\n\u003e :dart: This script was created in order to avoid the need to use another [extensions](https://portswigger.net/bappstore) or the [decoder](https://portswigger.net/burp/documentation/desktop/tools/decoder) to just see the content of the SAML request.\n\nExtract and pretty-display information from a [SAML request](https://auth0.com/blog/how-saml-authentication-works/) present in an HTTP request.\n\n![extract-saml-request-infos](images/extract-saml-request-infos.png)\n\n# Configuration\n\n\u003e :warning: Change the script location path defined in **prefix** field for all custom scripts **before** to import the configuration.\n\n\u003e After the import, do not forget to enable the scripts because they are all disabled by default by the import command.\n\n\u003e For **Highlighters**, the color can be changed before the import by changing the **color** field to one constants supported by PIPER/BURP.\n\nThe file [piper-config.yaml](piper-config.yaml) contains the complete configuration that I use for all my custom scripts.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frighettod%2Fburp-piper-custom-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frighettod%2Fburp-piper-custom-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frighettod%2Fburp-piper-custom-scripts/lists"}