Add option to use Engine.BURP to enable proxy support

PortSwigger / http-request-smuggler

https://portswigger.net/blog/http-desync-attacks

Other

952 stars 101 forks source link

Add option to use Engine.BURP to enable proxy support #17

Closed fraabye closed 4 years ago

fraabye commented 4 years ago

When testing in an IP restricted setting it would be handy to be able to switch the engine to Engine.BURP to use an existing project upstream proxy with http request smuggler.

Is this something that you would consider as an option for the default extension build?

albinowax commented 4 years ago

Just to clarify you understand that you can easily switch the engine to Engine.BURP yourself by editing the Python, but you want that to be the default? I choose the THREADED engine as the default for this attack because it's faster, which helps reduce the chance of interference from other people's requests.

If you want to change your personal default you should be able to simply edit the files in the resources folder inside the jar.

fraabye commented 4 years ago

Thanks for the clarification and plugin! I am aware that I could change it in the file myself, but I was hoping to avoid maintaining local changes and stick to the bApp store version. The THREADED engine is preferable in most cases and this was feature request for convenience, when testing an IP-restricted host through an upstream proxy. Feel free to close it if you consider it irrelevant.

albinowax commented 4 years ago

Sorry, I still think I'm misunderstanding something here.

The 'Smuggle probe' scan always uses Burp's request engine.
The 'Smuggle attack' option pops open a Turbo Intruder window containing Python which you can edit to change the request engine to Engine.BURP. Any changes made in this window are temporary.
Finally, it's possible to make permanent changes by editing the jar.

fraabye commented 4 years ago

Ok. Thanks for clarifying. I may be looking at another local issue.

The smuggle probe indicated issues that I could not reproduce with the "smuggle attack" and BURP engine. I suspected the reason could be the different engines. Missing responses may have been caused by server load.

I should have dropped to the wire and had a look before creating a ticket. :) Thanks for your time!

albinowax commented 4 years ago

Oh I know what that probably is. Burp repeater normalises headers ending in /n to /r/n. The smuggle probe check doesn't, and neither does Turbo Intruder (regardless of which engine you choose).

fraabye commented 4 years ago

Thanks @albinowax . I'll have a look at that.