This method returns an IScanQueueItem object and using this interface, you can find out the details about the active scan queue. IBurpExtenderCallbacks provide methods like ‘doActiveScan’ which can be used to send HTTP Request to the Burp Scanner to perform an active vulnerability scan. IScanQueueItem helps Burp extensions to access the “Active Scan” queue and retrieve more information like the number of issues reported, issue details, percentage completed till now, insertion points, etc. So if your BurpExtender implementation has implemented this method, every time there is a new issue you can perform some action on it i.e., extra logging, report generation or automatic bug filing.īurp supports two type of scanning, namely active and passive scanning. The IBurpExtender interface provides a method ‘newScanIssue’ which is invoked each time Burp Scanner discovers/reports a new issue. The IScanIssue interface is used to get the details of the issue like Severity, Confidence, URL, Issue Detail etc. This modified request can then be forwarded to any of the Burp tools i.e., Repeater, using callback methods. Here, we can get the details about the HTTP Message using the getter methods or by modifying the parameters of the request using the setter methods.

The IBurpExtender interface has a method “processHTTPMessage” which is invoked each time any of the Burp tools sends a client request or receives a response. Its two set of methods, getter and setter methods helps to get all the information or modify the message if needed. IHttpRequestResponse:Īll the HTTP messages captured with the Burp or Burp extension have details associated with it like host, port, request, response etc.

Using the callbacks interface, we can send requests to repeater/intruder, send alerts to the Alert tab, issue arbitrary requests and retrieve responses. Hence, it can call any of the methods described in the IBurpExtenderCallbacks. If BurpExtender (an implementation of IBurpExtender) implements this method, it receives an implementation of the IBurpExtenderCallbacks interface.

The IBurpExtender interface has a method “registerExtenderCallbacks”. It links the Burp tools like Repeater, Proxy, Intruder, etc., with the BurpExtender class with the help of functions like sendToRepeater, sendtoIntruder, etc. Its main purpose is to pass callback methods to the IBurpExtender interface implementation class (BurpExtender). This class is supposed to implement the IBurpExtender interface.Īfter BurpExtender is loaded during startup, whenever Burp Proxy receives a client request or server response it invokes the function “processProxyMessage” (if declared in the BurpExtender class).Īnother important interface to note while working on BurpSuite extension is the IBurpExtenderCallbacks interface. When we start Burp, it looks for a class BurpExtender in its classpath to load and instantiate.

It can be implemented by declaring a public class called “BurpExtender”. All the Burp extensions provide an implementation of this class by implementing at least one method of IBurpExtender interface. This interface forms the base of the BurpSuite extension. We will try and understand what each interface does and then in the later part of the article, we will see how various interfaces interact with the help of an example.

Burp suite