search

doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
https://doyensec.com/
Apache License 2.0
1.52k stars 156 forks source link

Store InQL state per Burp project #64

Closed execveat closed 1 year ago

execveat commented 1 year ago

Is your feature request related to a problem? Please describe.

  1. InQL stores settings and history in the same place.
  2. Over time the number of existing endpoints in InQL grows and pollutes the InQL Scanner tab.
  3. Previously saved targets get loaded on every next invocation of Burp / InQL and polute new projects.
  4. There is a user expectation that all stuff done in Temporary Project should be held in memory and not stored at disk, but this expectation is broken, because InQL does not make distinction between Temporary Projects and projects stored on disk.

Describe the solution you'd like Store InQL history per-project. In case of Temporary Projects, don't store history at all.

Additional context Project data is stored as a JSON string that gets saved by saveExtensionSetting API and gets loaded by corresponding loadExtensionSetting API call. Class name is used as an identification string in this API. In order to separate data per-project, project name should be added to this string.

Burp API does not offer a reliable method of querying current project name and the official suggestion seems to be scraping data from title bar. Burp API is in the process of a revamp though so better ways might appear soon.

execveat commented 1 year ago

The Settings window will be created in issue https://github.com/doyensec/inql/issues/100

This issue is just for implementing persistence API. The new Montoya API provides interface for modifying per-project Settings (only applies to Burp Pro, obviously). We still need a way to access global options as well.