Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/CoreyD97/Stepper
A natural evolution of Burp Suite's Repeater tool
https://github.com/CoreyD97/Stepper
Last synced: 3 months ago
JSON representation
A natural evolution of Burp Suite's Repeater tool
- Host: GitHub
- URL: https://github.com/CoreyD97/Stepper
- Owner: CoreyD97
- License: agpl-3.0
- Created: 2019-03-03T17:47:09.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2024-02-09T12:38:23.000Z (9 months ago)
- Last Synced: 2024-07-30T20:29:02.420Z (3 months ago)
- Language: Java
- Size: 694 KB
- Stars: 193
- Watchers: 7
- Forks: 37
- Open Issues: 30
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- WebHackersWeapons - Stepper
- awesome-burp-extensions - Stepper - Stepper is designed to be a natural evolution of Burp Suite's Repeater tool, providing the ability to create sequences of steps and define regular expressions to extract values from responses which can then be used in subsequent steps. (Payload Generators and Fuzzers / SSRF)
README
Stepper
A Multi-Stage Repeater Replacement For Burp Suite
**Created By: CoreyD97 [](https://twitter.com/coreyd97/)**
*Stepper is designed to be a natural evolution of Burp Suite's Repeater tool, providing the ability to create sequences of steps and define regular expressions to extract values from responses which can then be used in subsequent steps.*
*A step utilising a variable and defining a new variable for use in later steps.*
*Using Hackvertor tags with stepper for additional functionality.*
*Previewing message with replacements to be utilised*
**Building:**
1. Clone the repo
2. Use gradle to build the jar: `gradlew jar`
3. Add the built jar (`./releases/Stepper.jar`) to Burp Suite
**Usage:**
1. Create a new sequence. Double-click the title to set a suitable name.
2. Optional: Configure the global variables to use for the sequence.
3. Add your steps to the sequence manually, or using the context menu entry.
4. Optional: Define variables for steps, providing a regular expression which will be used to extract the values from the response.
Tip: You can execute a single step to test your regular expressions using the button in the top right.
5. Execute the entire sequence using the button at the bottom of the panel.
6. If you like the project, please give the repo a star! <3
**Variables:**
Variables can be defined for use within a sequence. Variables consist of an identifier and a regular expression, or in the case of initial variables defined in the Globals tab, an identifier and value.
Step variables, defined with a regular expression, have their values set from the response of the step in which they are defined. The variable is then available for use within the request of subsequent steps after their definition.
However, Global variables, defined with a literal initial value, can be used throughout the sequence.
Both step and global variables may be updated in later steps after their definition.
**Regular Expression Variables:**
Variables which are defined with a regular expression are updated each time the step in which they are defined is executed.
The regular expression is executed on the response received, with the first match being used as the new value.
If the defined regular expression has no groups defined, the whole match will be used.
If the regular expression defines capture groups, the first group will be used.
If groups are required but should not be used as the value, a non-capturing group may be used. e.g. (?:REGEX)
**Example:**
Response: "Hello People, Hello World!"
Expression: World|Earth, Result: World
Expression: Hello (World|Earth)!, Result: World
Expression: (?:Goodbye|Hello) (World)!, Result: World
**Variable Usage:**
To use a variable in a request after it has been defined, either use the option in the context menu to copy the parameter to the clipboard, or manually insert it by including it as below:
$VAR:VARIABLE_IDENTIFIER$
Read more about Stepper and its usage in this blog: [Stepper (Burp Extender): Burp’s best extender for automating sequence of requests so far!](https://iamyuthan.medium.com/stepper-burps-best-sequence-automation-extender-so-far-complete-tutorial-review-aa30e023e5f6)