🎉 burpsuite-project-file-parser v1.1 🎉

Thu, 21 Jul 2022 00:00:00 +0000

Edit: 1.1b fixes an auto shutdown issue in burpsuite, I would highly recommend this release over 1.1a. The rest of the post still applies.

This is a small release but a useful one.

Release 1.1b adds the ability to parse projects for portions of siteMap and proxyHistory. For example, the following will only respond with the proxyHistory request.headers and request.body. Note, the URL is always included:

1
2


java -jar -Djava.awt.headless=true [PATH_TO burpsuite_pro.jar] --project-file=[PATH TO PROJECT FILE] \
 proxyHistory.request.headers, proxyHistory.request.body

This should result in significant speed improvements as parsing will ignore response.body which can be very large. Conversely, if you only wanted to parse the proxyHistory response body for interesting things you could do:

1
2


java -jar -Djava.awt.headless=true [PATH_TO burpsuite_pro.jar] --project-file=[PATH TO PROJECT FILE] \
 proxyHistory.response.body

odle ruby gem: piping security data

Thu, 24 May 2018 00:00:00 +0000

I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be (1) simple, (2) fast, and (3) work on many platforms with only one dependency – nokogiri.

Quick Example of Piping Security Results

Below are two examples using odle to convert output from one tool (e.g. burpsuite) as input for something else (e.g. nmap scans). From the command line I typically use odle with gron which is an awesome tool that “makes json greppable” =).

Convert Burp to nmap script scan

Often I will take the passive data from one tool and feed it into another tool. One example is burp to something else; in this case, nmap script checks.

1
2
3
4
5
6
7
8


cat burp-scan.xml | odle --burp | gron | grep -i 'affected_hosts' | cut -d \" -f4 | cut -d/ -f3 | cut -d' ' -f1 | sort | uniq | xargs printf "nmap -sS -Pn -p 21 --script +ftp-anon %s \n"

nmap -sS -Pn -p 21 --script +ftp-anon apis.google.com 
nmap -sS -Pn -p 21 --script +ftp-anon developer.cdn.mozilla.net 
nmap -sS -Pn -p 21 --script +ftp-anon fakesite.com 
nmap -sS -Pn -p 21 --script +ftp-anon fonts.googleapis.com 
nmap -sS -Pn -p 21 --script +ftp-anon safebrowsing-cache.google.com 
nmap -sS -Pn -p 21 --script +ftp-anon safebrowsing.google.com 

Run nessus results through aquatone

1
2
3
4
5


cat nessus_v2.xml | odle --nessus | ~/Downloads/gron | grep -i 'affected_hosts' | cut -d \" -f4 | cut -d/ -f3 | cut -d' ' -f1 | sort | uniq | xargs printf "aquatone --discover %s \n"

aquatone --discover admin.fb.com
aquatone --discover js.fb.com
aquatone --discover blah.fb.com

Install

1
2


gem install nokogiri
gem install odle

Bugs