SQLiPy: A SQLMap Plugin for Burp

[Nytro]

[h=1]SQLiPy: A SQLMap Plugin for Burp[/h] By codewatch On September 22, 2014 · Leave a Comment

I perform quite a few web app assessments throughout the year. Two of the primary tools in my handbag for a web app assessment are Burp Suite Pro and SQLMap. Burp Suite is a great general purpose web app assessment tool, but if you perform web app assessments you probably already know because you are probably already using it. SQLMap complements Burp Suite nicely with its great SQL injection capabilities. It has astounded me in the past, as flexible and extensible as Burp is, that no one has written a better plugin to integrate the two (or maybe they did and I just missed it).

The plugins that I have come across in the past fit in one of two categories:

1. They generate the command line arguments that you want to run, and then you have to copy those arguments to the command line and run SQLMap yourself (like co2); or
   
2. They kick off a SQLMap scan and essentially display what you would see if run in a console window (like gason)
   

I’m not much of a developer, so I never really considered attempting to integrate the two myself until the other day that I was browsing in the SQLMap directory on my machine recently and noticed the file sqlmapapi.py. I’d never noticed it before (I’m not sure why), but when I did I immediately started looking into the purpose of the script. The sqlmapapi.py file is essentially a web server with a RESTful interface that enables you to configure, start, stop, and get the results from SQLMap scans by passing it options via JSON requests. This immediately struck me as an easy way in which to integrate Burp with SQLMap.

I began researching the API and was very fortunate that someone already did the leg work for me. The following blog post outlines the API: Volatile Minds: Unofficial SQLmap RESTful API documentation. Once I had the API down I set out to write the plugin. The key features that I wanted to integrate were:

1. The ability to start the API from within Burp. Note that this is not recommend as one of the limitations of Jython is that when you start a process with popen, you can’t get the PID, which means you can’t stop the process from within Jython (you have to manually kill it).
   
2. A context menu option for sending a request in Burp to the plugin.
   
3. A menu for editing and configuring the request prior to sending to SQLMap.
   
4. A thread that continuously checks up on executed scans to identify whether there were any findings.
   
5. Addition of information enumerated from successful SQLMap scans to the Burp Scanner Results list.
   

All of those features have been integrated into this first release. I have limited ability to test so I appreciate anyone that can use the plugin and provide feedback. Some general notes on the plugin development:

• This is the first time I’ve attempted to develop a Burp plugin. The fact that I was able to do so with relative ease shows how easy the Burp guys have made it.
  
• This is also the first time I’ve used Jython, or used any Java GUI code.
  
• The code probably looks awful and I need more comments. See points 1 & 2 above and add in the fact that I’m not a developer.
  

I reviewed the source code for numerous plugins to help me understand the nuances of working with Python/Jython/Java and integrating with Burp. The source of the following plugins was reviewed to help me understand how to build this:

• Payload Parser
  
• Burp SAML
  
• ActiveScan++
  
• WCF Binary SOAP Handler
  
• WSDL Wizard
  
• co2
  

Articol complet: https://www.codewatch.org/blog/?p=402