Lack of examples and documentation

[roman-soft]

Hi,

Currently, doc is very limited and should be expanded (imho). I think you are assuming the user of the extension knows about Burp's MontoyaAPI and the general inner workings of Burp from an extension-maker's point of view but this is not always the case.

Some concrete examples that a regular user of the extension would like to know:

• how to debug JS code. I still didn't find where Burp's "logger" is located (there is a logger tab in Burp but only showing HTTP requests, there isn't an "error console", or didn't find it).
• (very important) more examples, for instance, how to change a POST (=body) parameter in the request. The current doc only states that you need to use an HTTPParameter object, but I still dont know how to create it (in order to pass it to jsrequest.withParameter()). A complete example would help.
• basic flow of the modifications, I mean, all requests can be modified by JS? only those coming from Repeater / Intruder / whatever? What about scanning? Do scanner requests come thru JScriptor flow?
• how could the user test if plugin is working? Currently, the modified request can only be viewed in "logger" tab. This should have been stated in documentation.
• quick explanation of GUI options. Yes, they are few and seems self-explanatory... but...

The point here is not to assume that the user of the extension is an extensions' developper :)

Thank you for the extension!

[ngduyquockhanh]

Hi,

Thank you for your feedback.

I'm a bit busy at the moment, I'll update with more documents and examples in the next few days.

[roman-soft]

Thanks. Is it possible to reference an HTTPParameter class from js? How?-rEl 24 oct 2023 18:59, NGUYEN DUY QUOC KHANH @.***> escribió: Hi, Thank you for your feedback. I'm a bit busy at the moment, I'll update with more documents and examples in the next few days.

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: @.***>

[ngduyquockhanh]

Currently you cannot access HTTPParameter directly. i could edit the source code to make that possible, but i won't because we can use other functions to get and update the parameters like:

• path() to get url parameter, and you can update by using withPath()
• bodyToString() to get body parameter, and you can update by using withBody()

The documentation will be updated soon

[ngduyquockhanh]

Hello, Documentation has been updated. You can see it in Wiki

[roman-soft]

I'll try to review new doc and provide deeper feedback but at a first glance:

• README.md has been updated to reference to new wiki. My suggestion would be then to keep that reference and delete the rest of the information in order not to have possible desynced info (readme vs wiki).
• Readme still lists unusable methods like withParameter(). It is unusable since you confirmed HTTPParameter class is unreachable and you need that class to create a parameter object.
• I don't see the point in not using already existing methods like withParameters() which directly provides ways of reading and setting parameters easily, without the need to create extra functions in user's code. Indeed, it's the more intuitive method I guess the user will first try.
• I already had found the strings-based "workaround" by myself. This is the code I was using to read and change a body-parameter request:

codigo = decodeURIComponent( jsrequest.parameters()[0].value() ); email = decodeURIComponent( jsrequest.parameters()[1].value() ); api = decodeURIComponent( jsrequest.parameters()[2].value() ); api = decodeURIComponent(api); // Double encoding due to URI nesting

hash = cc(codigo + email + api);

body = jsrequest.bodyToString(); body = body.replace("FIXME", hash); jsrequest.withBody(body);

(in Repeater I set up the target parameter with a "FIXME" value).

Cheers, -r

[ngduyquockhanh]

Thank you. I will update README later.