Compare commits

...

10 Commits
1.0 ... 1.1

Author SHA1 Message Date
AnonymousUser
098b8e80d5 Fixed bug: fucntion colorUpgrade 2020-10-06 00:09:25 +08:00
AnonymousUser
405cb64dcf update 2020-09-23 19:43:02 +08:00
AnonymousUser
c073873405 update 2020-09-23 19:42:49 +08:00
AnonymousUser
ad486a41b3 update 2020-09-18 15:51:42 +08:00
AnonymousUser
ff2ea01ab1 Add Regex 2020-09-16 23:04:16 +08:00
AnonymousUser
4b7571c6c9 Add regexp 2020-09-16 18:43:54 +08:00
AnonymousUser
e72d46c458 Add regexp 2020-09-16 18:41:33 +08:00
AnonymousUser
4cd8f616b7 Add regexp 2020-09-16 18:41:23 +08:00
AnonymousUser
427dd68422 Fixed Bug 2020-09-14 20:25:47 +08:00
AnonymousUser
53af913f41 update 2020-09-14 18:55:49 +08:00
2 changed files with 50 additions and 31 deletions

View File

@@ -8,7 +8,7 @@
该插件可以通过自定义正则的方式匹配**响应报文**,可以自行决定符合该自定义正则匹配的相应请求是否需要高亮标记、信息提取。
`HaE`的使用,对测试人员来说需要基本的正则表达式基础,由于`Java`正则表达式的库并没有`Python`的优雅或方便在使用正则的HaE要求使用者必须使用`()`将所需提取的表达式内容包含;例如你要匹配一个**Shiro应用**的响应报文,正常匹配规则为`rememberMe=delete`,如果你要提取这段内容的话就需要变成`(rememberMe=delete)`
**注**`HaE`的使用,对测试人员来说需要基本的正则表达式基础,由于`Java`正则表达式的库并没有`Python`的优雅或方便在使用正则的HaE要求使用者必须使用`()`将所需提取的表达式内容包含;例如你要匹配一个**Shiro应用**的响应报文,正常匹配规则为`rememberMe=delete`,如果你要提取这段内容的话就需要变成`(rememberMe=delete)`
## 使用方法
@@ -28,7 +28,7 @@ HaE支持三个动作
2. 新建规则New新建规则会自动添加一行表格数据单击或双击进行修改数据即可自动保存
3. 删除规则Delete单击选中某条规则时按下该按钮即可删除规则。
HaE的操作都是基于表单UI的方式操作即会自动保存。
**注**HaE的操作都是基于表单UI的方式操作即会自动保存。
## 插件优点
@@ -78,10 +78,26 @@ HaE支持三个动作
2. OSS对象存储信息泄露正则`([A|a]ccess[K|k]ey[I|i]d|[A|a]ccess[K|k]ey[S|s]ecret)`
3. 内网地址信息提取,正则:`(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3})|(?:172\.(?:(?:1[6-9])|(?:2\d)|(?:3[01]))\.\d{1,3}\.\d{1,3})|(?:192\.168\.\d{1,3}\.\d{1,3})`
4. 实战插件关联搭配漏洞挖掘案例https://mp.weixin.qq.com/s/5vNn7dMRZBtv0ojPBAHV7Q
...还有诸多使用方法等待大家去发掘。
## 文末
随笔:正义感是一个不可丢失的东西。
Github项目地址BUG、需求、正则欢迎提交https://github.com/gh0stkey/HaE
Github项目地址BUG、需求、正则欢迎提交https://github.com/gh0stkey/HaE
### 收录正则列表
身份证号码来自https://github.com/gh0stkey/HaE/issues/3
```
[^0-9]([1-9]\d{5}(18|19|([23]\d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx])|([1-9]\d{5}\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{2}[0-9Xx])[^0-9]
```
邮箱地址:
```
([\w-]+(?:\.[\w-]+)*@(?:[\w](?:[\w-]*[\w])?\.)+[\w](?:[\w-]*[\w])?)
```

View File

@@ -49,7 +49,8 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
private static String configFilePath = "config.json";
private static String initFilePath = "init.hae";
private static String initConfigContent = "{\"Email\":{\"loaded\":true,\"highlight\":true,\"regex\":\"([\\\\w-]+(?:\\\\.[\\\\w-]+)*@(?:[\\\\w](?:[\\\\w-]*[\\\\w])?\\\\.)+[\\\\w](?:[\\\\w-]*[\\\\w])?)\",\"extract\":true,\"color\":\"yellow\"}}";
private String[] colorArray = new String[] {"red", "orange", "yellow", "green", "cyan", "blue", "pink", "magenta", "gray"};
private static String endColor = "";
private static String[] colorArray = new String[] {"red", "orange", "yellow", "green", "cyan", "blue", "pink", "magenta", "gray"};
private static IMessageEditorTab HaETab;
private static PrintWriter stdout;
@@ -68,8 +69,6 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
initialize();
// 判断"config.json"文件是否具备内容,如若不具备则进行初始化
if (configFilePath.equals("config.json")) {
if (readFileContent(configFilePath).equals("")) {
@@ -80,10 +79,13 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
// 判断配置文件是否存在
if (fileExists(configFilePath)) {
configFilePath = readFileContent(initFilePath);
fillTable();
} else {
JOptionPane.showMessageDialog(null, "Config File Not Found!", "Error", JOptionPane.ERROR_MESSAGE);
}
initialize();
fillTable();
}
});
callbacks.registerHttpListener(BurpExtender.this);
@@ -258,7 +260,8 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
*/
@Override
public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {
if (!messageIsRequest) {
// 判断是否是响应且该代码作用域为REPEATER、INTRUDER、PROXY分别对应toolFlag 64、32、4
if (!messageIsRequest && (toolFlag == 64 || toolFlag == 32 || toolFlag == 4)) {
byte[] content = messageInfo.getResponse();
JSONObject jsonObj = matchRegex(content);
if (jsonObj.length() > 0) {
@@ -274,7 +277,8 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
}
}
if (colorList.size() != 0) {
String color = colorUpgrade(getColorKeys(colorList));
colorUpgrade(getColorKeys(colorList));
String color = endColor;
messageInfo.setHighlight(color);
}
}
@@ -340,8 +344,7 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
boolean isExtract = jsonObj1.getBoolean("extract");
boolean isLoaded = jsonObj1.getBoolean("loaded");
if (isExtract && isLoaded) {
String tmpStr = String.format("[%s] %s \n", name, jsonObj1.getString("data"));
String tmpStr1 = new String(tmpStr).intern();
String tmpStr = String.format("[%s] %s \n", name, jsonObj1.getString("data")).intern();
result += tmpStr;
}
}
@@ -421,35 +424,35 @@ public class BurpExtender implements IBurpExtender, IHttpListener, IMessageEdito
/*
* 颜色升级递归算法
*/
private String colorUpgrade(List<Integer> colorList) {
private static String colorUpgrade(List<Integer> colorList) {
int colorSize = colorList.size();
colorList.sort(Comparator.comparingInt(Integer::intValue));
int i = 0;
List<Integer> stack = new ArrayList<Integer>();
while (i < colorSize) {
if (stack.size() > 0) {
stack.add(colorList.get(i));
i++;
} else if (colorList.get(i) != stack.stream().reduce((first, second) -> second).orElse(999999)) {
if (stack.isEmpty()) {
stack.add(colorList.get(i));
i++;
} else {
stack.set(stack.size() - 1, stack.get(stack.size() - 1) - 1);
i++;
}
}
int stackSize = stack.size();
// 利用HashSet删除重复元素
HashSet tmpList = new HashSet(stack);
stack.clear();
stack.addAll(tmpList);
if (stackSize == stack.size()) {
List<String> endColorList = new ArrayList<String>();
for (int j = 0; j < stack.size(); j++) {
int num = stack.get(j);
endColorList.add(colorArray[num]);
if (colorList.get(i) != stack.stream().reduce((first, second) -> second).orElse(99999999)) {
stack.add(colorList.get(i));
i++;
} else {
stack.set(stack.size() - 1, stack.get(stack.size() - 1) - 1);
i++;
}
}
return endColorList.get(0);
}
// 利用HashSet删除重复元素
HashSet tmpList = new HashSet(stack);
if (stack.size() == tmpList.size()) {
stack.sort(Comparator.comparingInt(Integer::intValue));
if(stack.get(0).equals(-1)) {
endColor = colorArray[0];
} else {
endColor = colorArray[stack.get(0)];
}
} else {
colorUpgrade(stack);
}