tomsteele / burpbuddy

burpbuddy exposes Burp Suites's extender API over the network through various mediums, with the goal of enabling development in any language without the restrictions of the JVM
MIT License
156 stars 25 forks source link

Cookie Jar with no expiration and no path #35

Closed Marantz2600 closed 6 years ago

Marantz2600 commented 7 years ago

Thanks very much for building this project. I really like it.

I was trying to use the jar function but it was giving me errors. The problem was cookies with no expiration and no path.

I got it to work by tweaking the code. I have no experience using kotlin so my changes are suspect... But here they are.

The result after changing the source code.

----> curl localhost:8001/jar
[{"domain":"xsgy.com","expiration":"","path":"/","name":"session","value":".eJwVzD0OgzAMBtC7eO6QOOSHXqYyn40qQZMqtCxV7w6sb3g_wtbnx6ctVulOLolxUkxsITrxCdACjhllHiSPDlx0CBxTZBV2IQcZs_qCCV490416W-2c1HZb29v6Sd_NepXXxU-pC_0PML8jqg.DMvkZA.hhiTfA3YQ_A7rYyL4yDEse7t8tE"},{"domain":"xsgy.com","expiration":"","path":"","name":"session","value":".eJwVzD0OgzAMBtC7eO6QOOSHXqYyn40qQZMqtCxV7w6sb3g_wtbnx6ctVulOLolxUkxsITrxCdACjhllHiSPDlx0CBxTZBV2IQcZs_qCCV490416W-2c1HZb29v6Sd_NepXXxU-pC_0PML8jqg.DMvkZA.hhiTfA3YQ_A7rYyL4yDEse7t8tE"},{"domain":"xsgy.com","expiration":"","path":"","name":"io","value":"93f9f757614745cbafe9e9b05f608608"}]

The changes to the code:

diff --git a/src/main/kotlin/burp/API.kt b/src/main/kotlin/burp/API.kt
index d0d8b60..45ec357 100644
--- a/src/main/kotlin/burp/API.kt
+++ b/src/main/kotlin/burp/API.kt
@@ -171,9 +171,21 @@ class API() {
         })

         get("/jar", fun(req: Request, res: Response): String{
-            val cookies = callbacks.cookieJarContents.map { Cookie(it.domain, it.expiration, it.path, it.name, it.value) }
+            val cookies = callbacks.cookieJarContents.map { Cookie(it.domain, it.expiration, it.path ?: "", it.name, it.value) }
             res.status(200)
-            return jsonArray(cookies).toString()
+            val r = jsonArray()
+            for (c in cookies) {
+                var expiration = ""
+                if (c.expiration != null)
+                    expiration = c.expiration.toString()
+                r.add(jsonObject(
+                    "domain" to c.domain,
+                    "expiration" to expiration,
+                    "path" to c.path,
+                    "name" to c.name,
+                    "value" to c.value))
+            }
+            return r.toString()
         })

         post("/jar", fun(req: Request, res: Response): String {
diff --git a/src/main/kotlin/burp/BCookie.kt b/src/main/kotlin/burp/BCookie.kt
index 53b6f1b..45d004b 100644
--- a/src/main/kotlin/burp/BCookie.kt
+++ b/src/main/kotlin/burp/BCookie.kt
@@ -7,7 +7,7 @@ class BCookie(val cookie: Cookie): ICookie {
         return cookie.domain
     }

-    override fun getExpiration(): Date {
+    override fun getExpiration(): Date? {
         return cookie.expiration
     }

diff --git a/src/main/kotlin/burp/BurpToBuddy.kt b/src/main/kotlin/burp/BurpToBuddy.kt
index 996fdae..6061655 100644
--- a/src/main/kotlin/burp/BurpToBuddy.kt
+++ b/src/main/kotlin/burp/BurpToBuddy.kt
@@ -52,6 +52,9 @@ class BurpToBuddy(val callbacks: IBurpExtenderCallbacks) {
             var expiration = ""
             if (cookie.expiration != null)
                 expiration = cookie.expiration.toString()
+            var path = ""
+            if (cookie.path != null)
+                path = cookie.path
             cookies.add(jsonObject(
                     "domain" to cookie.domain,
                     "expiration" to expiration,
diff --git a/src/main/kotlin/burp/Cookie.kt b/src/main/kotlin/burp/Cookie.kt
index 76f2bf6..8eefdbd 100644
--- a/src/main/kotlin/burp/Cookie.kt
+++ b/src/main/kotlin/burp/Cookie.kt
@@ -2,4 +2,4 @@ package burp

 import java.util.Date

-data class Cookie(val domain: String, val expiration: Date, val path: String, val name: String, val value: String)
\ No newline at end of file
+data class Cookie(val domain: String, val expiration: Date?, val path: String, val name: String, val value: String)