https://github.com/JackJ07/Response-Pattern-Matcher

Adds extensibility to Burp by using a list of payloads to pattern match on HTTP responses highlighting interesting and potentially vulnerable areas.
https://github.com/JackJ07/Response-Pattern-Matcher

Last synced: 3 months ago
JSON representation

Adds extensibility to Burp by using a list of payloads to pattern match on HTTP responses highlighting interesting and potentially vulnerable areas.

• Host: GitHub
• URL: https://github.com/JackJ07/Response-Pattern-Matcher
• Owner: jackj07
• Created: 2020-02-04T11:56:15.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2023-08-04T12:40:58.000Z (over 1 year ago)
• Last Synced: 2024-04-08T10:34:36.931Z (7 months ago)
• Language: Java
• Size: 6.34 MB
• Stars: 16
• Watchers: 1
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-burp-extensions - Response Pattern Matcher - Adds extensibility to Burp by using a list of payloads to pattern match on HTTP responses highlighting interesting and potentially vulnerable areas. (Custom Features)

README

        
# Response Pattern Matcher

Adds extensibility to Burp by using a list of payloads to pattern match on HTTP responses highlighting interesting and potentially vulnerable areas. Can be used to search HTML source code for interesting keywords, developer comments, passwords, admin panel links, hidden form fields, and more.

# Usage

The .jar file is available in the /releases directory, this can be loaded in through Burp Extender.



When the extension is loaded in you will see a Response Pattern Matcher tab, by default pre-existing payloads exist that will be pattern matched against every response that goes through Burp. This includes tools such as the Scanner.

Configure these payloads accordingly, these are quite generic so for an assessment you may want to add project specific keywords and regular expressions.

The is regex check box indicates whether to search the responses for the provided Pattern using Java's Pattern Matcher functionality. A good example is available below.

The active check box indicates whether the payload will be used. Uncheck this to disable the payload.

Use the "In Scope Only" checkbox to search only within responses that are in Scope defined under Target > Scope.

Use the config tab to choose whether to match on Requests and or Responses. Matches against either of these are available under the Matches tab.

For best results, define your scope, configure your payloads, and then start testing. Burp's Scanner will kick in and push everything through the Response Pattern Matcher too so the tool searches the full sitemap.

If you want to test the matches against a request or response again you can send the item to repeater from the HTTP history in Burp.



Note /* cannot be set to be regex, this will most likely crash burp as it matches on everything.



[Java regex tutorial](http://vogella.com/tutorials/JavaRegularExpressions/article.html)

# Matches

As of v2.0 additional functionality has been added to organise matches. 


If you highlight items in the Matches tab you can highlight identical matches, as well as delete and export them to a .json file.

# Requirements

Built using: 

- Oracle OpenJDK 17.0.8

- burp-extender-api (2.3)

- Tested on Burp Community Edition 2023.7.1

# Acknowledgements

Author: Jack Jarvis, Bridewell 


Developed using IntelliJ IDE and the Gradle Build Tool.





CoreyD97 Burp Extender Utilities:


https://github.com/CoreyD97/BurpExtenderUtilities





For further Burp Extension development please refer to:


https://portswigger.net/burp/documentation/desktop/extensions