Package burp
Interface IScannerInsertionPoint
-
public interface IScannerInsertionPointThis interface is used to define an insertion point for use by active Scanner checks. Extensions can obtain instances of this interface by registering anIScannerCheck, or can create instances for use by Burp's own scan checks by registering anIScannerInsertionPointProvider.
-
-
Field Summary
Fields Modifier and Type Field Description static byteINS_ENTIRE_BODYUsed to indicate where the payload is inserted into the body of the HTTP request.static byteINS_EXTENSION_PROVIDEDUsed to indicate where the insertion point is provided by an extension-registeredIScannerInsertionPointProvider.static byteINS_HEADERUsed to indicate where the payload is inserted into the value of an HTTP request header.static byteINS_PARAM_AMFUsed to indicate where the payload is inserted into the value of an AMF parameter.static byteINS_PARAM_BODYUsed to indicate where the payload is inserted into the value of a body parameter.static byteINS_PARAM_COOKIEUsed to indicate where the payload is inserted into the value of an HTTP cookie.static byteINS_PARAM_JSONUsed to indicate where the payload is inserted into the value of an item of data within a JSON structure.static byteINS_PARAM_MULTIPART_ATTRUsed to indicate where the payload is inserted into the value of a parameter attribute within a multi-part message body (such as the name of an uploaded file).static byteINS_PARAM_NAME_BODYUsed to indicate where the payload is inserted into the name of an added body parameter.static byteINS_PARAM_NAME_URLUsed to indicate where the payload is inserted into the name of an added URL parameter.static byteINS_PARAM_URLUsed to indicate where the payload is inserted into the value of a URL parameter.static byteINS_PARAM_XMLUsed to indicate where the payload is inserted into the value of an item of data within an XML data structure.static byteINS_PARAM_XML_ATTRUsed to indicate where the payload is inserted into the value of a tag attribute within an XML structure.static byteINS_UNKNOWNUsed to indicate where the payload is inserted at an unknown location within the request.static byteINS_URL_PATH_FILENAMEUsed to indicate where the payload is inserted into the URL path filename.static byteINS_URL_PATH_FOLDERUsed to indicate where the payload is inserted into a URL path folder.static byteINS_URL_PATH_RESTDeprecated.static byteINS_USER_PROVIDEDUsed to indicate where the payload is inserted at a location manually configured by the user.
-
Method Summary
All Methods Instance Methods Abstract Methods Modifier and Type Method Description byte[]buildRequest(byte[] payload)This method is used to build a request with the specified payload placed into the insertion point.java.lang.StringgetBaseValue()This method returns the base value for this insertion point.java.lang.StringgetInsertionPointName()This method returns the name of the insertion point.bytegetInsertionPointType()This method returns the type of the insertion point.int[]getPayloadOffsets(byte[] payload)This method is used to determine the offsets of the payload value within the request, when it is placed into the insertion point.
-
-
-
Field Detail
-
INS_PARAM_URL
static final byte INS_PARAM_URL
Used to indicate where the payload is inserted into the value of a URL parameter.- See Also:
- Constant Field Values
-
INS_PARAM_BODY
static final byte INS_PARAM_BODY
Used to indicate where the payload is inserted into the value of a body parameter.- See Also:
- Constant Field Values
-
INS_PARAM_COOKIE
static final byte INS_PARAM_COOKIE
Used to indicate where the payload is inserted into the value of an HTTP cookie.- See Also:
- Constant Field Values
-
INS_PARAM_XML
static final byte INS_PARAM_XML
Used to indicate where the payload is inserted into the value of an item of data within an XML data structure.- See Also:
- Constant Field Values
-
INS_PARAM_XML_ATTR
static final byte INS_PARAM_XML_ATTR
Used to indicate where the payload is inserted into the value of a tag attribute within an XML structure.- See Also:
- Constant Field Values
-
INS_PARAM_MULTIPART_ATTR
static final byte INS_PARAM_MULTIPART_ATTR
Used to indicate where the payload is inserted into the value of a parameter attribute within a multi-part message body (such as the name of an uploaded file).- See Also:
- Constant Field Values
-
INS_PARAM_JSON
static final byte INS_PARAM_JSON
Used to indicate where the payload is inserted into the value of an item of data within a JSON structure.- See Also:
- Constant Field Values
-
INS_PARAM_AMF
static final byte INS_PARAM_AMF
Used to indicate where the payload is inserted into the value of an AMF parameter.- See Also:
- Constant Field Values
-
INS_HEADER
static final byte INS_HEADER
Used to indicate where the payload is inserted into the value of an HTTP request header.- See Also:
- Constant Field Values
-
INS_URL_PATH_FOLDER
static final byte INS_URL_PATH_FOLDER
Used to indicate where the payload is inserted into a URL path folder.- See Also:
- Constant Field Values
-
INS_URL_PATH_REST
@Deprecated static final byte INS_URL_PATH_REST
Deprecated.Used to indicate where the payload is inserted into a URL path folder. This is now deprecated; useINS_URL_PATH_FOLDERinstead.- See Also:
- Constant Field Values
-
INS_PARAM_NAME_URL
static final byte INS_PARAM_NAME_URL
Used to indicate where the payload is inserted into the name of an added URL parameter.- See Also:
- Constant Field Values
-
INS_PARAM_NAME_BODY
static final byte INS_PARAM_NAME_BODY
Used to indicate where the payload is inserted into the name of an added body parameter.- See Also:
- Constant Field Values
-
INS_ENTIRE_BODY
static final byte INS_ENTIRE_BODY
Used to indicate where the payload is inserted into the body of the HTTP request.- See Also:
- Constant Field Values
-
INS_URL_PATH_FILENAME
static final byte INS_URL_PATH_FILENAME
Used to indicate where the payload is inserted into the URL path filename.- See Also:
- Constant Field Values
-
INS_USER_PROVIDED
static final byte INS_USER_PROVIDED
Used to indicate where the payload is inserted at a location manually configured by the user.- See Also:
- Constant Field Values
-
INS_EXTENSION_PROVIDED
static final byte INS_EXTENSION_PROVIDED
Used to indicate where the insertion point is provided by an extension-registeredIScannerInsertionPointProvider.- See Also:
- Constant Field Values
-
INS_UNKNOWN
static final byte INS_UNKNOWN
Used to indicate where the payload is inserted at an unknown location within the request.- See Also:
- Constant Field Values
-
-
Method Detail
-
getInsertionPointName
java.lang.String getInsertionPointName()
This method returns the name of the insertion point.- Returns:
- The name of the insertion point (for example, a description of a particular request parameter).
-
getBaseValue
java.lang.String getBaseValue()
This method returns the base value for this insertion point.- Returns:
- the base value that appears in this insertion point in the base
request being scanned, or
nullif there is no value in the base request that corresponds to this insertion point.
-
buildRequest
byte[] buildRequest(byte[] payload)
This method is used to build a request with the specified payload placed into the insertion point. There is no requirement for extension-provided insertion points to adjust the Content-Length header in requests if the body length has changed, although Burp-provided insertion points will always do this and will return a request with a valid Content-Length header. Note: Scan checks should submit raw non-encoded payloads to insertion points, and the insertion point has responsibility for performing any data encoding that is necessary given the nature and location of the insertion point.- Parameters:
payload- The payload that should be placed into the insertion point.- Returns:
- The resulting request.
-
getPayloadOffsets
int[] getPayloadOffsets(byte[] payload)
This method is used to determine the offsets of the payload value within the request, when it is placed into the insertion point. Scan checks may invoke this method when reporting issues, so as to highlight the relevant part of the request within the UI.- Parameters:
payload- The payload that should be placed into the insertion point.- Returns:
- An int[2] array containing the start and end offsets of the payload within the request, or null if this is not applicable (for example, where the insertion point places a payload into a serialized data structure, the raw payload may not literally appear anywhere within the resulting request).
-
getInsertionPointType
byte getInsertionPointType()
This method returns the type of the insertion point.- Returns:
- The type of the insertion point. Available types are defined in this interface.
-
-