search

Quitten / Autorize

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests
928 stars 196 forks source link

Interception Filter based on Burp's listener port #109

Open M-Davies opened 1 year ago

M-Davies commented 1 year ago

I've found that I've become used to running external tools through Burp's proxy for evidence/logging reasons but these requests are automatically picked up by Autorize, which is obviously pointless and fills up the log with rubbish entries.

It would be great if there was an Interception filter for autorize to allow you to whitelist and/or blacklist the listener port. Then, I would be able to multitask by running tools through port 8081 (for example) while doing other tests through port 8080.

Quitten commented 1 year ago

Hey @M-Davies, thanks for your feedback. The only way to get the proxy listener interface is via getListenerInterface There is no an easy way to make request bypass interception and not reach autorize, so I added interception filter to drop all other requests from a specific listeners via port in e9b97a2c6be473434c1842ec2629539106a004c5.

Another idea in mind is to flag the request and then filter it our while reaching IHttpListener but I don't have time to implement such solution in the near future, I will be glad to have community help doing it.

Hopefully this will stratify your needs.

M-Davies commented 1 year ago

Thanks for looking into this @Quitten. Unfortunately my use case is that I would like to run tools through one burp proxy (8081) while autorize requests go through a different one (e.g. 8080).

Is it not possible to do this with autorize? I see that there's some functionality to drop ports so surely it should be possible to force Autorize to only listien to requests from one specific port no? Autorize-Ports