SlideShare a Scribd company logo

Burp Extender API for Penetration Testing

P
Pichaya Morimoto

The document is a guide on the Burp Extender API for penetration testing, authored by P. Morimoto and published in February 2018. It includes instructions on installation, setup, and usage of the Burp Suite along with details about developing extensions using Java, Python, and Ruby. Various tools and functionalities related to web application security testing are also covered.

Technology
Related topics:
Computer Security
1 of 45
Downloaded 48 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
Version: [--VX.X--] Date: [--YYYY-MM-DD--] Author: [--Author--] Responsible: [--Responsible--] Confidentiality Class: [--Confidentiality Class--] Version: 1.0 Date: 2018-02-09 Author: P. Morimoto Responsible: P. Morimoto Confidentiality Class: Public Burp Extender API for Pentest
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Vienna (HQ) | AT Wiener Neustadt | AT Vilnius | LT Berlin| DE Montreal | CA Singapore | SG Moscow | RU Zurich | CH SEC Consult Offices SEC Consult Clients Bangkok | TH SEC Consult – Who we are Found in 2002 70+ Security Experts 400+ Security Audits per year Globally operating SEC Consult Vulnerability Lab Malaysia | MY Luxembourg | LU Linz | AT
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 3 Web Pentest Tools • WVS • Acunetix • … • OWASP ZAP • Fiddler • BurpSuite
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 4 BurpSuite
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 5 How web browser works? (1/1) https://www.quackit.com/web_servers/tutorial/how_web_servers_work.cfm
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 6 How web browser works? (1/2)
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 7 How Burp works? http://kalilinuxtutorials.com/burpsuite/
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 8 Install & Setup https://portswigger.net/burp/communitydownload
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 9 Install & Setup
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 10 Burp Basic - Repeater
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 11 Burp Basic - Intruder
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 12 BurpSuite - Scanner (Professional Edition)
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 13 BurpSuite - Extender
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 14 BurpSuite - Extender - JSON Beautifier
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 15 Develop BurpSuite extension • Java • Python (Jython) • Ruby (JRuby) Tutorial https://portswigger.net/burp/extender/writing-your-first-burp-suite-extension Sample extensions https://portswigger.net/burp/extender#SampleExtensions
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 16 Burp Extension with Jython Extender > APIs
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 17 Burp Extension with Jython Extender > Options Extender > Extension
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 18 IBurpExtender Implement - registerExtenderCallbacks()
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 19 IBurpExtender - registerExtenderCallbacks ตั#งชื'อ ส่งข้อความไปตาม จุดต่าง ๆ ใน Burp
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 20 IHttpListener IHttpListener implements - processHttpMessage()
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 21 IHttpListener IHttpListener implements - processHttpMessage()
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 22 IExtensionHelpers
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 23 IExtensionHelpers + IRequestInfo IRequestInfo
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 24 IExtensionHelpers + IRequestInfo getUrl(); getHeaders(); getParameters(); getBodyOffset(); getContentType();
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 25 IRequestInfo getUrl(); getHeaders(); getParameters(); getBodyOffset(); getContentType();
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 26 Demo 1 : Decode Base64 in Request ntok=YWN0aW9uPWRlbGV0ZVVzZXImaWQ9MTAz
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 27 Demo 1 : Decode Base64 in Request Select > Send to Decoder Select > Convert selection > Base64 > Base64-decode
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 28 Demo 1 : Decode Base64 in Request https://github.com/PortSwigger/example-custom-editor-tab/blob/master/python/CustomEditorTab.py
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 29 Demo 1 : Decode Base64 in Request Old workflow 1. Intercept request, send to Repeater 2. Click, select and copy Base64 data 3. Go to Base64 Decoder tool or tabs 4. Decode it 5. Edit the data 6. Go to Base64 Encoder tool or tabs 7. Encode it 8. Click, select and copy Base64 data 9. Go to Repeater tab 10.Click Go
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 30 Demo 1 : Decode Base64 in Request Old workflow 1. Intercept request, send to Repeater 2. Click, select and copy Base64 data 3. Go to Base64 Decoder tool or tabs 4. Decode it 5. Edit the data 6. Go to Base64 Encoder tool or tabs 7. Encode it 8. Click, select and copy Base64 data 9. Go to Repeater tab 10.Click Go New workflow 1. Intercept request, send to Repeater 2. Click on a tab under Repeater 3. Edit the data 4. Click Go
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 31 IMessageEditorTabFactory + IMessageEditorTab
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 32 IMessageEditorTabFactory + IMessageEditorTab @TODO Get Base64 > decode > Encode back > set to request
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 33 IMessageEditorTabFactory + IMessageEditorTab
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 34 IMessageEditorTab - setMessage 1 2 3 4 API docs: Extender > APIs > IMessageEditorTab
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 35 IMessageEditorTab - getMessage 1 2 API docs: Extender > APIs > IMessageEditorTab
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 36 So Who the hell will spend some time writing code for just decoding Base64?
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 37 Demo 2: Custom Encoding
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 38 Demo 2: Custom Encoding
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 39 Pop-quiz: Can WVS find vulnerability in … Will be decoded at server-side
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 40 Example 3: Mobile App + Payload Encryption
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 41 Example 3: Mobile App + Payload Encryption {"key":"1234567890123456","text":"pCnmUF4RzY+nE3GHFP VqTw4U0QQyqTiaJbXp7E7m/+k="} Mobile App BackEnd Web API
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 42 Example 4: Burp Randomizer Extension https://github.com/thomaspatzke/Burp-Randomizer/blob/master/Burp-Randomizer.py
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 43 Example 5: Custom Scanner https://github.com/PortSwigger/example-scanner-checks/blob/master/python/CustomScannerChecks.py
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved For any further questions contact your SEC Consult Expert. Pichaya Morimoto p.morimoto@sec-consult.com SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building, 16B Soi Langsuan, Lumpini, Pathumwan Bangkok 10330, Thailand www.sec-consult.com
© 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 45 Contact GERMANY SEC Consult Unternehmensberatung Deutschland GmbH Bockenheimer Landstraße 17-19 60325 Frankfurt / Main Tel +49 69 175 373 43 | Fax +49 69 175 373 44 Email office-frankfurt@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Mooslackengasse 17 1190 Vienna Tel +43 1 890 30 43 0 | Fax +43 1 890 30 43 15 Email office@sec-consult.com LITHUANIA UAB Critical Security, a SEC Consult company Sauletekio al. 15-311 10224 Vilnius Tel +370 5 2195535 Email office-vilnius@sec-consult.com RUSSIA CJCS Security Monitor 5th Donskoy proyezd, 15, Bldg. 6 119334, Moscow Tel +7 495 662 1414 Email info@securitymonitor.ru SINGAPORE SEC Consult Singapore PTE. LTD 4 Battery Road #25-01 Bank of China Building Singapore (049908) Email office-singapore@sec-consult.com CANADA i-SEC Consult Inc. 100 René-Lévesque West, Suite 2500 Montréal (Quebec) H3B 5C9 Email office-montreal@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Komarigasse 14/1 2700 Wiener Neustadt Tel +43 1 890 30 43 0 Email office@sec-consult.com THAILAND SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building 16th Floor, 16B Soi Langsuan, Ploen Chit Road Lumpini, Patumwan | Bangkok 10330 Tel +66 02 041 1146 Email office-bangkok@sec-consult.com www.sec-consult.com

More Related Content

PPTX
Threat modeling web application: a case study
Antonio Fontes
 
PDF
Marp Tutorial
Rui Watanabe
 
PDF
企業のオープンソース活動を支える Open Source Program Office (OSPO)
takanori suzuki
 
PDF
Secure Code Review 101
Narudom Roongsiriwong, CISSP
 
PDF
CSI Driverを開発し自社プライベートクラウドにより適した安全なKubernetes Secrets管理を実現した話
Katsuya Yamaguchi
 
PDF
React(TypeScript) + Go + Auth0 で実現する管理画面
KentaEndoh
 
PDF
Threat Modeling for Dummies - Cascadia PHP 2018
Adam Englander
 
PDF
[Warsaw 26.06.2018] SDL Threat Modeling principles
OWASP
 
Threat modeling web application: a case study
Antonio Fontes
 
Marp Tutorial
Rui Watanabe
 
企業のオープンソース活動を支える Open Source Program Office (OSPO)
takanori suzuki
 
Secure Code Review 101
Narudom Roongsiriwong, CISSP
 
CSI Driverを開発し自社プライベートクラウドにより適した安全なKubernetes Secrets管理を実現した話
Katsuya Yamaguchi
 
React(TypeScript) + Go + Auth0 で実現する管理画面
KentaEndoh
 
Threat Modeling for Dummies - Cascadia PHP 2018
Adam Englander
 
[Warsaw 26.06.2018] SDL Threat Modeling principles
OWASP
 

What's hot (20)

PPTX
[CB16] WireGuard:次世代耐乱用性カーネルネットワークトンネル by Jason Donenfeld
CODE BLUE
 
PPTX
NGINXをBFF (Backend for Frontend)として利用した話
Hitachi, Ltd. OSS Solution Center.
 
PDF
REST API のコツ
pospome
 
PPTX
ROSチュートリアル ROBOMECH2018
Ryuichi Ueda
 
PDF
"CERT Secure Coding Standards" by Dr. Mark Sherman
Rinaldi Rampen
 
PPTX
ゲームインフラコンテナ実践導入
Hiroki Tamiya
 
PPTX
REST API、gRPC、GraphQL 触ってみた【2023年12月開催勉強会資料】
洵貴 佐川
 
PDF
BridgePointを使ったモデル駆動開発（ETロボコン環境のご紹介）
Yuki Tsuchitoi
 
PDF
今日からはじめるリファクタリング
Junya Shimazu
 
PDF
TLA+についての話
takahashi takahashi
 
PDF
IoT時代におけるストリームデータ処理と急成長の Apache Flink
Takanori Suzuki
 
PDF
Java によるクラウドネイティブ の実現に向けて
Shigeru Tatsuta
 
PDF
Go言語によるwebアプリの作り方
Yasutaka Kawamoto
 
PDF
FridaによるAndroidアプリの動的解析とフッキングの基礎
ken_kitahara
 
PDF
Threat Modeling Using STRIDE
Girindro Pringgo Digdo
 
PDF
Parser combinatorってなんなのさ
cct-inc
 
PPTX
Argo CD Deep Dive
shunki fujiwara
 
PPTX
initとプロセス再起動
Takashi Takizawa
 
PDF
The Security Code Review Guide
Nicola Pietroluongo
 
PDF
分散システムの限界について知ろう
Shingo Omura
 
[CB16] WireGuard:次世代耐乱用性カーネルネットワークトンネル by Jason Donenfeld
CODE BLUE
 
NGINXをBFF (Backend for Frontend)として利用した話
Hitachi, Ltd. OSS Solution Center.
 
REST API のコツ
pospome
 
ROSチュートリアル ROBOMECH2018
Ryuichi Ueda
 
"CERT Secure Coding Standards" by Dr. Mark Sherman
Rinaldi Rampen
 
ゲームインフラコンテナ実践導入
Hiroki Tamiya
 
REST API、gRPC、GraphQL 触ってみた【2023年12月開催勉強会資料】
洵貴 佐川
 
BridgePointを使ったモデル駆動開発（ETロボコン環境のご紹介）
Yuki Tsuchitoi
 
今日からはじめるリファクタリング
Junya Shimazu
 
TLA+についての話
takahashi takahashi
 
IoT時代におけるストリームデータ処理と急成長の Apache Flink
Takanori Suzuki
 
Java によるクラウドネイティブ の実現に向けて
Shigeru Tatsuta
 
Go言語によるwebアプリの作り方
Yasutaka Kawamoto
 
FridaによるAndroidアプリの動的解析とフッキングの基礎
ken_kitahara
 
Threat Modeling Using STRIDE
Girindro Pringgo Digdo
 
Parser combinatorってなんなのさ
cct-inc
 
Argo CD Deep Dive
shunki fujiwara
 
initとプロセス再起動
Takashi Takizawa
 
The Security Code Review Guide
Nicola Pietroluongo
 
分散システムの限界について知ろう
Shingo Omura
 
Ad

Similar to Burp Extender API for Penetration Testing (20)

PDF
Bug Bounty แบบแมว ๆ
Pichaya Morimoto
 
PDF
Security Misconfiguration (OWASP Top 10 - 2013 - A5)
Pichaya Morimoto
 
PDF
Pentest 101 @ Mahanakorn Network Research Laboratory
Pichaya Morimoto
 
PDF
Csw2016 freingruber bypassing_application_whitelisting
CanSecWest
 
PPTX
Spring one2gx 2014 erdemgunay
Erdem Gunay
 
PPTX
How to Build More Secure Service Brokers
VMware Tanzu
 
PDF
Eliv 2015 bosch-hammel-presentation_v3.4
Christof Hammel
 
PDF
Living on the Edge With Spring Cloud Gateway - Cora Iberkleid
VMware Tanzu
 
PDF
Living on the Edge With Spring Cloud Gateway - Cora Iberkleid
VMware Tanzu
 
PPT
OMA LwM2M Workshop - Joaquin Prado, OMA LwM2M Technical Summary
Open Mobile Alliance
 
PDF
Bringing New Experience with Openstack and Fuel (Ihor Dvoretskyi, Oleksandr M...
IT Arena
 
PDF
Spring Cloud Gateway - Ryan Baxter
VMware Tanzu
 
PPTX
My Personal DevOps Journey: From Pipelines to Platforms
VMware Tanzu
 
PPTX
Mule4 EAIESB Meetup
Vijay Reddy
 
PPTX
PKS Networking with NSX-T: You Focus on your App, We'll Take Care of the Rest!
VMware Tanzu
 
PPTX
Ibm innovate-2014 #2478-hammel_pub
Christof Hammel
 
PPTX
Experience + Education = Empowerment
VMware Tanzu
 
PPTX
Accel series 2020_winter-en
NTTDATA INTRAMART
 
PPT
VMukti Collaborative Conferencing Engine For V1034 to V1038
vmukti
 
PDF
Bosch Technical Trainings Supported by Augmented Reality
AugmentedWorldExpo
 
Bug Bounty แบบแมว ๆ
Pichaya Morimoto
 
Security Misconfiguration (OWASP Top 10 - 2013 - A5)
Pichaya Morimoto
 
Pentest 101 @ Mahanakorn Network Research Laboratory
Pichaya Morimoto
 
Csw2016 freingruber bypassing_application_whitelisting
CanSecWest
 
Spring one2gx 2014 erdemgunay
Erdem Gunay
 
How to Build More Secure Service Brokers
VMware Tanzu
 
Eliv 2015 bosch-hammel-presentation_v3.4
Christof Hammel
 
Living on the Edge With Spring Cloud Gateway - Cora Iberkleid
VMware Tanzu
 
Living on the Edge With Spring Cloud Gateway - Cora Iberkleid
VMware Tanzu
 
OMA LwM2M Workshop - Joaquin Prado, OMA LwM2M Technical Summary
Open Mobile Alliance
 
Bringing New Experience with Openstack and Fuel (Ihor Dvoretskyi, Oleksandr M...
IT Arena
 
Spring Cloud Gateway - Ryan Baxter
VMware Tanzu
 
My Personal DevOps Journey: From Pipelines to Platforms
VMware Tanzu
 
Mule4 EAIESB Meetup
Vijay Reddy
 
PKS Networking with NSX-T: You Focus on your App, We'll Take Care of the Rest!
VMware Tanzu
 
Ibm innovate-2014 #2478-hammel_pub
Christof Hammel
 
Experience + Education = Empowerment
VMware Tanzu
 
Accel series 2020_winter-en
NTTDATA INTRAMART
 
VMukti Collaborative Conferencing Engine For V1034 to V1038
vmukti
 
Bosch Technical Trainings Supported by Augmented Reality
AugmentedWorldExpo
 
Ad

More from Pichaya Morimoto (12)

PDF
ยกระดับศักยภาพของทีม IT Security องค์กรด้วย CTF & Cybersecurity Online Platfo...
Pichaya Morimoto
 
PDF
Securing and Hacking LINE OA Integration
Pichaya Morimoto
 
PDF
Docker Plugin For DevSecOps
Pichaya Morimoto
 
PDF
Mysterious Crypto in Android Biometrics
Pichaya Morimoto
 
PDF
Web Hacking with Object Deserialization
Pichaya Morimoto
 
PDF
Exploiting Blind Vulnerabilities
Pichaya Morimoto
 
PDF
From Web Vulnerability to Exploit in 15 minutes
Pichaya Morimoto
 
PDF
Exploiting WebApp Race Condition Vulnerability 101
Pichaya Morimoto
 
PDF
CTF คืออะไร เรียนแฮก? ลองแฮก? แข่งแฮก?
Pichaya Morimoto
 
PDF
Vulnerable Active Record: A tale of SQL Injection in PHP Framework
Pichaya Morimoto
 
PDF
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
Pichaya Morimoto
 
PDF
Art of Web Backdoor - Pichaya Morimoto
Pichaya Morimoto
 
ยกระดับศักยภาพของทีม IT Security องค์กรด้วย CTF & Cybersecurity Online Platfo...
Pichaya Morimoto
 
Securing and Hacking LINE OA Integration
Pichaya Morimoto
 
Docker Plugin For DevSecOps
Pichaya Morimoto
 
Mysterious Crypto in Android Biometrics
Pichaya Morimoto
 
Web Hacking with Object Deserialization
Pichaya Morimoto
 
Exploiting Blind Vulnerabilities
Pichaya Morimoto
 
From Web Vulnerability to Exploit in 15 minutes
Pichaya Morimoto
 
Exploiting WebApp Race Condition Vulnerability 101
Pichaya Morimoto
 
CTF คืออะไร เรียนแฮก? ลองแฮก? แข่งแฮก?
Pichaya Morimoto
 
Vulnerable Active Record: A tale of SQL Injection in PHP Framework
Pichaya Morimoto
 
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
Pichaya Morimoto
 
Art of Web Backdoor - Pichaya Morimoto
Pichaya Morimoto
 

Recently uploaded (20)

PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
KodekX | Application Modernization Development
KodekX
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
KodekX | Application Modernization Development
KodekX
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 

Burp Extender API for Penetration Testing

  • 1. Version: [--VX.X--] Date: [--YYYY-MM-DD--] Author: [--Author--] Responsible: [--Responsible--] Confidentiality Class: [--Confidentiality Class--] Version: 1.0 Date: 2018-02-09 Author: P. Morimoto Responsible: P. Morimoto Confidentiality Class: Public Burp Extender API for Pentest
  • 2. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Vienna (HQ) | AT Wiener Neustadt | AT Vilnius | LT Berlin| DE Montreal | CA Singapore | SG Moscow | RU Zurich | CH SEC Consult Offices SEC Consult Clients Bangkok | TH SEC Consult – Who we are Found in 2002 70+ Security Experts 400+ Security Audits per year Globally operating SEC Consult Vulnerability Lab Malaysia | MY Luxembourg | LU Linz | AT
  • 3. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 3 Web Pentest Tools • WVS • Acunetix • … • OWASP ZAP • Fiddler • BurpSuite
  • 4. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 4 BurpSuite
  • 5. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 5 How web browser works? (1/1) https://www.quackit.com/web_servers/tutorial/how_web_servers_work.cfm
  • 6. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 6 How web browser works? (1/2)
  • 7. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 7 How Burp works? http://kalilinuxtutorials.com/burpsuite/
  • 8. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 8 Install & Setup https://portswigger.net/burp/communitydownload
  • 9. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 9 Install & Setup
  • 10. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 10 Burp Basic - Repeater
  • 11. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 11 Burp Basic - Intruder
  • 12. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 12 BurpSuite - Scanner (Professional Edition)
  • 13. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 13 BurpSuite - Extender
  • 14. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 14 BurpSuite - Extender - JSON Beautifier
  • 15. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 15 Develop BurpSuite extension • Java • Python (Jython) • Ruby (JRuby) Tutorial https://portswigger.net/burp/extender/writing-your-first-burp-suite-extension Sample extensions https://portswigger.net/burp/extender#SampleExtensions
  • 16. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 16 Burp Extension with Jython Extender > APIs
  • 17. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 17 Burp Extension with Jython Extender > Options Extender > Extension
  • 18. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 18 IBurpExtender Implement - registerExtenderCallbacks()
  • 19. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 19 IBurpExtender - registerExtenderCallbacks ตั#งชื'อ ส่งข้อความไปตาม จุดต่าง ๆ ใน Burp
  • 20. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 20 IHttpListener IHttpListener implements - processHttpMessage()
  • 21. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 21 IHttpListener IHttpListener implements - processHttpMessage()
  • 22. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 22 IExtensionHelpers
  • 23. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 23 IExtensionHelpers + IRequestInfo IRequestInfo
  • 24. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 24 IExtensionHelpers + IRequestInfo getUrl(); getHeaders(); getParameters(); getBodyOffset(); getContentType();
  • 25. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 25 IRequestInfo getUrl(); getHeaders(); getParameters(); getBodyOffset(); getContentType();
  • 26. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 26 Demo 1 : Decode Base64 in Request ntok=YWN0aW9uPWRlbGV0ZVVzZXImaWQ9MTAz
  • 27. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 27 Demo 1 : Decode Base64 in Request Select > Send to Decoder Select > Convert selection > Base64 > Base64-decode
  • 28. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 28 Demo 1 : Decode Base64 in Request https://github.com/PortSwigger/example-custom-editor-tab/blob/master/python/CustomEditorTab.py
  • 29. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 29 Demo 1 : Decode Base64 in Request Old workflow 1. Intercept request, send to Repeater 2. Click, select and copy Base64 data 3. Go to Base64 Decoder tool or tabs 4. Decode it 5. Edit the data 6. Go to Base64 Encoder tool or tabs 7. Encode it 8. Click, select and copy Base64 data 9. Go to Repeater tab 10.Click Go
  • 30. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 30 Demo 1 : Decode Base64 in Request Old workflow 1. Intercept request, send to Repeater 2. Click, select and copy Base64 data 3. Go to Base64 Decoder tool or tabs 4. Decode it 5. Edit the data 6. Go to Base64 Encoder tool or tabs 7. Encode it 8. Click, select and copy Base64 data 9. Go to Repeater tab 10.Click Go New workflow 1. Intercept request, send to Repeater 2. Click on a tab under Repeater 3. Edit the data 4. Click Go
  • 31. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 31 IMessageEditorTabFactory + IMessageEditorTab
  • 32. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 32 IMessageEditorTabFactory + IMessageEditorTab @TODO Get Base64 > decode > Encode back > set to request
  • 33. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 33 IMessageEditorTabFactory + IMessageEditorTab
  • 34. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 34 IMessageEditorTab - setMessage 1 2 3 4 API docs: Extender > APIs > IMessageEditorTab
  • 35. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 35 IMessageEditorTab - getMessage 1 2 API docs: Extender > APIs > IMessageEditorTab
  • 36. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 36 So Who the hell will spend some time writing code for just decoding Base64?
  • 37. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 37 Demo 2: Custom Encoding
  • 38. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 38 Demo 2: Custom Encoding
  • 39. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 39 Pop-quiz: Can WVS find vulnerability in … Will be decoded at server-side
  • 40. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 40 Example 3: Mobile App + Payload Encryption
  • 41. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 41 Example 3: Mobile App + Payload Encryption {"key":"1234567890123456","text":"pCnmUF4RzY+nE3GHFP VqTw4U0QQyqTiaJbXp7E7m/+k="} Mobile App BackEnd Web API
  • 42. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 42 Example 4: Burp Randomizer Extension https://github.com/thomaspatzke/Burp-Randomizer/blob/master/Burp-Randomizer.py
  • 43. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 43 Example 5: Custom Scanner https://github.com/PortSwigger/example-scanner-checks/blob/master/python/CustomScannerChecks.py
  • 44. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved For any further questions contact your SEC Consult Expert. Pichaya Morimoto p.morimoto@sec-consult.com SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building, 16B Soi Langsuan, Lumpini, Pathumwan Bangkok 10330, Thailand www.sec-consult.com
  • 45. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Burp Extender API for Pentest | Responsible: P. Morimoto Version / Date: 1.0 / 2018-02-09 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 45 Contact GERMANY SEC Consult Unternehmensberatung Deutschland GmbH Bockenheimer Landstraße 17-19 60325 Frankfurt / Main Tel +49 69 175 373 43 | Fax +49 69 175 373 44 Email office-frankfurt@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Mooslackengasse 17 1190 Vienna Tel +43 1 890 30 43 0 | Fax +43 1 890 30 43 15 Email office@sec-consult.com LITHUANIA UAB Critical Security, a SEC Consult company Sauletekio al. 15-311 10224 Vilnius Tel +370 5 2195535 Email office-vilnius@sec-consult.com RUSSIA CJCS Security Monitor 5th Donskoy proyezd, 15, Bldg. 6 119334, Moscow Tel +7 495 662 1414 Email info@securitymonitor.ru SINGAPORE SEC Consult Singapore PTE. LTD 4 Battery Road #25-01 Bank of China Building Singapore (049908) Email office-singapore@sec-consult.com CANADA i-SEC Consult Inc. 100 René-Lévesque West, Suite 2500 Montréal (Quebec) H3B 5C9 Email office-montreal@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Komarigasse 14/1 2700 Wiener Neustadt Tel +43 1 890 30 43 0 Email office@sec-consult.com THAILAND SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building 16th Floor, 16B Soi Langsuan, Ploen Chit Road Lumpini, Patumwan | Bangkok 10330 Tel +66 02 041 1146 Email office-bangkok@sec-consult.com www.sec-consult.com