直接看代码吧,BurpExtender.java:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
package burp;

import javax.swing.*;
import javax.swing.table.AbstractTableModel;
import javax.swing.table.TableModel;
import java.awt.*;
import java.io.PrintWriter;
import java.net.URL;
import java.util.*;
import java.util.List;
import java.util.concurrent.atomic.AtomicBoolean;

public class BurpExtender extends AbstractTableModel implements IBurpExtender, IScannerCheck, ITab, IMessageEditorController, IHttpListener{
private IBurpExtenderCallbacks callbacks;
private IExtensionHelpers helpers;
private JSplitPane splitPane;
private IMessageEditor requestViewer;
private IMessageEditor scanViewer;
private IMessageEditor responseViewer;
private List<VulEntry> vul_list = new ArrayList<VulEntry>();
private IHttpRequestResponse currentlyDisplayedItem;
public PrintWriter stdout;

final String WebSocket_Word = "Upgrade: websocket";
final String Evil_Domain = "http://evil.com";

@Override
public void registerExtenderCallbacks(final IBurpExtenderCallbacks callbacks){

this.callbacks = callbacks;
this.stdout = new PrintWriter(callbacks.getStdout(), true);
this.helpers = callbacks.getHelpers();

this.stdout.println("Author: Mi1k7ea");

callbacks.setExtensionName("CORS CrossDomain Vul Scan");
callbacks.registerScannerCheck(this);

// create our UI
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
// main split pane
splitPane = new JSplitPane(JSplitPane.VERTICAL_SPLIT);

// table of vul entries
Table vulTable = new Table(BurpExtender.this);
JScrollPane scrollPane = new JScrollPane(vulTable);
splitPane.setLeftComponent(scrollPane);

// tabs with request/response viewers
JTabbedPane tabs = new JTabbedPane();
requestViewer = callbacks.createMessageEditor(BurpExtender.this, false);
scanViewer = callbacks.createMessageEditor(BurpExtender.this, false);
responseViewer = callbacks.createMessageEditor(BurpExtender.this, false);
tabs.addTab("Origin Request", requestViewer.getComponent());
tabs.addTab("Fuzzing Request", scanViewer.getComponent());
tabs.addTab("Response", responseViewer.getComponent());
splitPane.setRightComponent(tabs);

// customize our UI components
callbacks.customizeUiComponent(splitPane);
callbacks.customizeUiComponent(vulTable);
callbacks.customizeUiComponent(scrollPane);
callbacks.customizeUiComponent(tabs);

// add the custom tab to Burp's UI
callbacks.addSuiteTab(BurpExtender.this);

// register ourselves as an HTTP listener
callbacks.registerHttpListener(BurpExtender.this);
}
});
}

@Override
public List<IScanIssue> doPassiveScan(
IHttpRequestResponse baseRequestResponse) {
this.stdout.println("[*]Passive Scan: " + baseRequestResponse.getHttpService());

// 获取请求方法
String method = this.helpers.analyzeRequest(baseRequestResponse).getMethod();

// 提取请求参数
List<IParameter> baseParams = this.helpers.analyzeRequest(baseRequestResponse.getRequest()).getParameters();
StringBuilder sb = new StringBuilder();
baseParams.forEach(p -> {
if (sb.length() > 0) {
sb.append("&" + p.getName() + "=" + p.getValue());
} else {
sb.append(p.getName() + "=" + p.getValue());
}
});
String baseRequestParams = sb.toString();

scanCORS(baseRequestResponse, method, baseRequestParams);

return null;
}

@Override
public List<IScanIssue> doActiveScan(
IHttpRequestResponse baseRequestResponse,
IScannerInsertionPoint insertionPoint) {
// TODO here
return null;
}

@Override
public int consolidateDuplicateIssues(IScanIssue existingIssue,
IScanIssue newIssue) {
// TODO here
return 0;
}

@Override
public String getTabCaption() {
return "CORS跨域漏洞扫描器";
}

@Override
public Component getUiComponent() {
return this.splitPane;
}

@Override
public IHttpService getHttpService() {
return this.currentlyDisplayedItem.getHttpService();
}

@Override
public byte[] getRequest() {
return this.currentlyDisplayedItem.getRequest();
}

@Override
public byte[] getResponse() {
return this.currentlyDisplayedItem.getResponse();
}

@Override
public int getRowCount() {
return vul_list.size();
}

@Override
public int getColumnCount() {
return 2;
}

@Override
public String getColumnName(int columnIndex) {
switch (columnIndex) {
case 0:
return "Name";
case 1:
return "URL";
default:
return "";
}
}

@Override
public Class<?> getColumnClass(int columnIndex) {
return String.class;
}

@Override
public Object getValueAt(int rowIndex, int columnIndex) {
VulEntry vulEntry = vul_list.get(rowIndex);

switch (columnIndex) {
case 0:
return vulEntry.vul_name;
case 1:
return vulEntry.url.toString();
default:
return "";
}
}

@Override
public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {

}

// extend JTable to handle cell selection
private class Table extends JTable {
public Table(TableModel tableModel) {
super(tableModel);
}

@Override
public void changeSelection(int row, int col, boolean toggle, boolean extend) {
VulEntry vulEntry = vul_list.get(row);
requestViewer.setMessage(vulEntry.baseRequestResponse.getRequest(), true);
scanViewer.setMessage(vulEntry.fuzzingRequestResponse.getRequest(), true);
responseViewer.setMessage(vulEntry.fuzzingRequestResponse.getResponse(), false);
currentlyDisplayedItem = vulEntry.fuzzingRequestResponse;

super.changeSelection(row, col, toggle, extend);
}
}


private static class VulEntry {
String vul_name;
IHttpRequestResponsePersisted baseRequestResponse;
IHttpRequestResponsePersisted fuzzingRequestResponse;
URL url;

public VulEntry(String vul_name, IHttpRequestResponsePersisted baseRequestResponse, IHttpRequestResponsePersisted fuzzingRequestResponse, URL url) {
this.vul_name = vul_name;
this.baseRequestResponse = baseRequestResponse;
this.fuzzingRequestResponse = fuzzingRequestResponse;
this.url = url;
}
}


void scanCORS(IHttpRequestResponse baseRequestResponse, String method, String baseRequestParams) {
List<String> response_headers = this.helpers.analyzeResponse(baseRequestResponse.getResponse()).getHeaders();
AtomicBoolean acao = new AtomicBoolean(false);
AtomicBoolean acac = new AtomicBoolean(false);

response_headers.forEach(header -> {
if (header.toLowerCase().startsWith("access-control-allow-origin: ")) {
acao.set(true);
}
if (header.toLowerCase().equals("access-control-allow-credentials: true")) {
acac.set(true);
}
});

// 这里添加了ACAC为true的条件,也可以去掉,看实际情况
if (acao.get() && acac.get()) {
// 替换Origin头为恶意域名
List<String> fuzzing_headers = this.helpers.analyzeRequest(baseRequestResponse).getHeaders();
fuzzing_headers.forEach(header -> {
if (header.toLowerCase().startsWith("origin:")) {
Collections.replaceAll(fuzzing_headers, header, "Origin: " + this.Evil_Domain);
}
});

byte[] baseBody = null;

if (method.equals("POST")) {
baseBody = this.helpers.stringToBytes(baseRequestParams);
}

byte[] fuzzingBody = this.helpers.buildHttpMessage(fuzzing_headers, baseBody);
IHttpRequestResponse fuzzingRequestResponse = this.callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), fuzzingBody);


if (this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getHeaders().contains("Access-Control-Allow-Origin: " + this.Evil_Domain)
|| this.helpers.analyzeResponse(fuzzingRequestResponse.getResponse()).getHeaders().contains("Access-Control-Allow-Origin: *")) {
this.stdout.println("[!]存在CORS跨域漏洞!");

int row = this.vul_list.size();
this.vul_list.add(
new VulEntry(
"CORS跨域漏洞",
this.callbacks.saveBuffersToTempFiles(baseRequestResponse),
this.callbacks.saveBuffersToTempFiles(fuzzingRequestResponse),
this.helpers.analyzeRequest(fuzzingRequestResponse).getUrl()
)
);
fireTableRowsInserted(row, row);
}

}
}

}

效果:

小问题:有些接口请求没有带Origin头但是可能存在CORS跨域漏洞,跨域针对这种情况自行判断响应存在ACAC后重新构造的请求报文中添加Origin头来测试。