search

xnl-h4ck3r / GAP-Burp-Extension

Burp Extension to find potential endpoints, parameters, and generate a custom target wordlist
1.28k stars 136 forks source link

[Feature request] support for nested objects #22

Open tarishard opened 1 year ago

tarishard commented 1 year ago

Hello,

Would it be possible that nested objects are selected? For example, if you find an object like {"user":{"address":{"street":"foobar street","number":1337}}} generate the following:

user address street number user[address] user[address][street] user[address][number] address[street] address[number]

This would be great for testing mass assignment (among other things)

tarishard commented 1 year ago

this can happen for URL parameters as well i.e https://example.com?user[address][number]=19.

xnl-h4ck3r commented 1 year ago

Hi @tarishard. Thanks for using GAP and raising this issue. I'll add it to the list and see what I can do :)

xnl-h4ck3r commented 1 year ago

Just to let you know... It is already taken care off with the paramaters in the query string being shown in that format. These are displayed in the same way in the potential parameter output. It's just the JSON body that is a problem at the moment.

xnl-h4ck3r commented 1 week ago

The question below was asked in https://github.com/xnl-h4ck3r/GAP-Burp-Extension/issues/34 as an extra question not related to the original issue. I am copying it below as I think its realted to this issue, and closing 34.

Want to get the parameter names username and password from this type of object: 325446303-069d5131-c989-4b0d-b949-884298dd4777