xnl-h4ck3r / GAP-Burp-Extension

Burp Extension to find potential endpoints, parameters, and generate a custom target wordlist
1.2k stars 131 forks source link

Edit features : current version is unable to indentify keys that are not enclosed between ' or " #19

Closed mohammadx0098 closed 3 months ago

mohammadx0098 commented 1 year ago

for example : pageName

        dataLayer.push({
            environment: 'prod',
            industryCategory: '###',
            pageName: '####',
            pageTitle: '#####',
            notifications: {
              bokadirekt: false,
              reviews: false,
            },
        })

to fix this I try adding this code to line 3350 ... and it worked for me. there are some false positive but it was ok for me.


  # Find keys without " or ' in json object
  try:
      js_keys = re.finditer(
          r"(?<!;)\s([\w\d]+)(?:\:\s*)(?=\"|\')?[\w\s-]*(?=\"|\')?(?!;)",
          body,
          re.IGNORECASE,
      )
      for key in js_keys:
          if key is not None and key.group() != "":
              self.addParameter(key.group().strip().split(':')[0],responseUrl)
  except Exception as e:
      pass
xnl-h4ck3r commented 1 year ago

Hey @mohammadx0098. Thanks for using GAP and taking the time to raise this. I'll have a look into it next week and try to get an update out Regards Xnl

xnl-h4ck3r commented 1 year ago

Thanks for looking into it and suggesting the code. Unfortunately I get a mostly false positives with this particular regex. For example if you have code case 0:a=1337 then you end up with 0 as a parameter name, or just a string like "User status: suspended" would give you a paramater of status.

There is a lot possible ways that variables are declared in javascript and all quite difficult to get accuratley with regex. That's why I just stuck to the basic var, let and const initially. Unfortunately I'm not a JS expert to know all those possible ways. For the case of dataLayer.push I think you'd need to identify the whole data structure (so dataLayer.push would be in the regex, and then get the parameters from that).

Or maybe there's another way of using a third party library that actually parses javascript?

xnl-h4ck3r commented 3 months ago

Hi @mohammadx0098 . If you get the latest version of GAP, v5.2, and make sure you select the "Javascript variables and constants" option under Parameters, then it should retrieve the keys for dataLayer.push now. If you want to give it a try and let me know if it resolves ypur issue, then let me know. Thanks

mohammadx0098 commented 3 months ago

Hi @xnl-h4ck3r Thank you for resolving this issue.