HaE: BurpSuite Highlighter and Extractor

HaE – Highlighter and Extractor

HaE is used to highlight HTTP requests and extract information from HTTP response messages or request messages.

The plugin can custom regular expressions to match HTTP response messages. You can decide for yourself whether the corresponding request that meets the custom regular expression match needs to be highlighted and information extracted.

Note: The use of HaE requires a basic regular expression foundation for testers. Since the Java regular expression library is not as elegant or convenient as Python when using regular expressions, HaE requires users to use () to extract what they need The expression content contains; for example, if you want to match a response message of a Shiro application, the normal matching rule is rememberMe=delete, if you want to extract this content, you need to become (rememberMe=delete).

Install

Load: Extender – Extensions – Add – Select File – Next

The configuration file is initialized when HaE is loaded for the first time. The default configuration file has a built-in regular expression: Email. The initialized configuration file will be placed in the same directory as the BurpSuite Jar package.

In addition to the initial configuration file, there is init.hae, which is used to store the configuration file path; HaE supports custom configuration file paths, and you can select a custom configuration file by clicking the Select File button.

HaE supports three actions:

1. Reload: It can be used when you do not use the HaE UI interface to modify the rules in the configuration file, but directly modify the rules based on the configuration file;
2. New: Add a new rule will automatically add a row of table data, click or double-click to modify the data to automatically save;
3. Delete: When you click to select a rule, press this button to delete the rule.

Note: HaE’s operations are based on the form of UI, and all operations will be automatically saved.

Plugin Advantages

1. Multi-option custom adaptation requirements;
2. Multi-color classification (colors of BurpSuite): red, orange, yellow, green, cyan, blue, pink, magenta, gray;
3. Color upgrade algorithm: Two regulars expressions, the colors are both orange, if the request is matched these, it will be upgraded to red.
4. The configuration file format uses JSON format, the format is{name: {“loaded”: isLoaded,”regex”: regexText, “scope”: request/response/any, “action”: extract/highlight/any, “color”: colorText, “engine”: dfa/nfa}}
5. Built-in simple cache to reduce the stuttering phenomenon in the multi-regular, big data scenario.

Regular Expression Optimization

Some regular expressions is not ideal in actual combat application scenarios.

There will be some false positives when regular expression matches mobile phone numbers (pure numbers), the mobile phone number processing can be solved:

Original regular expression:

1[3-9]\d{9}

False-positive scenario:12315188888888123, it will match15188888888, but this paragraph is not a mobile phone number, so the modification rule is:

[^0-9]+(1[3-9]\d{9})[^0-9]+

The mobile phone number required to be matched cannot be a number from 0-9.

Download