https://github.com/silentsignal/burp-uuid

UUID issues for Burp Suite
https://github.com/silentsignal/burp-uuid

burp uuid

Last synced: about 1 month ago
JSON representation

UUID issues for Burp Suite

• Host: GitHub
• URL: https://github.com/silentsignal/burp-uuid
• Owner: silentsignal
• License: mit
• Created: 2017-02-16T16:12:45.000Z (almost 8 years ago)
• Default Branch: master
• Last Pushed: 2022-06-02T06:50:27.000Z (over 2 years ago)
• Last Synced: 2024-08-02T00:22:51.354Z (4 months ago)
• Topics: burp, uuid
• Language: Java
• Homepage: https://blog.silentsignal.eu/2017/02/17/not-so-unique-snowflakes/
• Size: 43.9 KB
• Stars: 49
• Watchers: 8
• Forks: 11
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

• awesome-burp-extensions - UUID issues for Burp Suite - UUID issues for Burp Suite. (Vulnerability Specific Extensions / Broken Access Control)

README

        
UUID issues for Burp Suite

==========================

When faced with the problem of identifying entities,  many solutions depend on

UUIDs or GUIDs. However, although being unique doesn’t necessarily make these

identifiers unguessable.

This plugin performs a quick analysis on every request sent as part of passive

scanning, so no additional traffic is generated. The plugin has no UI of its

own, and aside from adding it to Burp, there’s no additional configuration

necessary, it just works.

In case of UUIDs above version 2, it just adds an information-level issue.

However in case of version 1 and 2, a medium severity issue is added, along

with the information that can be extracted from the UUID itself.

[Read more about this plugin in our blog post][1]

Building

--------

Execute `ant`, and you'll have the plugin ready in `burp-uuid.jar`

Dependencies

------------

 - JDK 1.8+ (tested on OpenJDK 8, Debian/Ubuntu package: `openjdk-8-jdk`)

 - Apache ANT (Debian/Ubuntu package: `ant`)

License

-------

The whole project is available under MIT license, see `LICENSE.txt`.

  [1]: https://blog.silentsignal.eu/2017/02/17/not-so-unique-snowflakes/