Burpstrike

I read this blog post about running w3af plugins in Burpsuite:
http://blog.ombrepixel.com/post/2010/09/09/Running-w3af-plugins-in-Burp-Suite

I thought it was such a great idea that I decided to do the same with my friend's Carlos del Ojo, aka deepbit, proxystrike tool. You can find more details about this tool at http://www.edge-security.com/proxystrike.php.


I'm new to jython and i've found some problems regarding imports, enabling readline, enabling setuptools and some "maximum recursion depth exceeded" errors, so this code should be expected as been buggy and not very reliable because it is only a proof-of-concept and it lacks a lot of features but it is useful enough to play with.


You can run burpstrike from linux using the shell script burpstrike.sh. This script will launch the burpstrike console and burp suite itself.


I've tested the tool with acunetix's vulnerable demo web http://testasp.vulnweb.com and burpsuite_v1.3.03.jar:


First of all, you have to add the testing site to burp scope and then enable burpstrike and all its plugins with:


enable
activate_plugins


Every vulnerability will be reflected in the alert tab of burp and also using the command "issues" from burpstrike's command line:


<pre>

(Cmd) enable
(Cmd) activate_plugins

(Cmd) issues

Cross site scripting
        URL:http://testasp.vulnweb.com:80/Search.asp?tfSearch=test
        Origin: Gazpacho
        Detail: [(True, 'GET', u'tfSearch', ["' (Single Quotes) (Normal Encoding)", '" (Double Quotes) (Normal Encoding)', '<, > (Less than and great than symbols) (Normal Encoding)', '( ) (Parenthesis) (Normal Encoding)', 'Scripting keywords enabled (Normal Encoding)'], u'test')]
</pre>



You can download the tool from http://code.google.com/p/pysqlin/downloads/list.


Enjoy!