#

# implement IBurpExtender

#

def registerExtenderCallbacks(self, callbacks):

# keep a reference to our Burp callbacks object

self._callbacks = callbacks

# obtain an Burp extension helpers object

self._helpers = callbacks.getHelpers()

# set our extension name

callbacks.setExtensionName("AuthMatrix - v"+AUTHMATRIX_VERSION)

# DB that holds everything users, roles, and messages

self._db = MatrixDB()

# For saving/loading config

self._fc = JFileChooser()

# Used by inner classes

selfExtender = self

self._selectedColumn = -1

self._selectedRow = -1

# Table of Chain entries (NOTE: must be instantiated before userTable since its referenced)

self._chainTable = ChainTable(model = ChainTableModel(self))

chainScrollPane = JScrollPane(self._chainTable)

self._chainTable.redrawTable()

# Table of User entries

self._userTable = UserTable(model = UserTableModel(self))

roleScrollPane = JScrollPane(self._userTable)

self._userTable.redrawTable()

# Table of Request (AKA Message) entries

self._messageTable = MessageTable(model = MessageTableModel(self))

messageScrollPane = JScrollPane(self._messageTable)

self._messageTable.redrawTable()

# Set Messages to reorderable

self._messageTable.setDragEnabled(True)

self._messageTable.setDropMode(DropMode.INSERT_ROWS)

self._messageTable.setTransferHandler(RowTransferHandler(self._messageTable))

# Set Users to reorderable

self._userTable.setDragEnabled(True)

self._userTable.setDropMode(DropMode.INSERT_ROWS)

self._userTable.setTransferHandler(RowTransferHandler(self._userTable))

# Semi-Generic Popup stuff

def addPopup(component, popup):

class genericMouseListener(MouseAdapter):

def mousePressed(self, e):

if e.isPopupTrigger():

self.showMenu(e)

def mouseReleased(self, e):

if e.isPopupTrigger():

self.showMenu(e)

def showMenu(self, e):

# NOTE: testing if .locked is ok here since its a manual operation

if selfExtender._db.lock.locked():

return

if type(component) is JTableHeader:

table = component.getTable()

column = component.columnAtPoint(e.getPoint())

if (type(table) is MessageTable

and column >= selfExtender._db.STATIC_MESSAGE_TABLE_COLUMN_COUNT

or type(table) is UserTable

and column >= selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT):

selfExtender._selectedColumn = column

else:

return

else:

selfExtender._selectedRow = component.rowAtPoint(e.getPoint())

popup.show(e.getComponent(), e.getX(), e.getY())

component.addMouseListener(genericMouseListener())

class actionRunMessage(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

indexes = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)._index]

else:

indexes = [selfExtender._db.getMessageByRow(rowNum)._index for rowNum in selfExtender._messageTable.getSelectedRows()]

t = Thread(target=selfExtender.runMessagesThread, args = [indexes])

t.start()

selfExtender._selectedColumn = -1

# Redrawing the table happens in colorcode within the thread

class actionToggleEnableUser(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._userTable.getSelectedRows():

usersArray = [selfExtender._db.getUserByRow(selfExtender._selectedRow)]

else:

usersArray = [selfExtender._db.getUserByRow(rowNum) for rowNum in selfExtender._userTable.getSelectedRows()]

for userEntry in usersArray:

userEntry.toggleEnabled()

selfExtender._selectedColumn = -1

selfExtender._userTable.redrawTable()

class actionToggleEnableMessage(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

messagesArray = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)]

else:

messagesArray = [selfExtender._db.getMessageByRow(rowNum) for rowNum in selfExtender._messageTable.getSelectedRows()]

for messageEntry in messagesArray:

messageEntry.toggleEnabled()

selfExtender._selectedColumn = -1

selfExtender._messageTable.redrawTable()

class actionToggleEnableChain(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._chainTable.getSelectedRows():

chainArray = [selfExtender._db.getChainByRow(selfExtender._selectedRow)]

else:

chainArray = [selfExtender._db.getChainByRow(rowNum) for rowNum in selfExtender._chainTable.getSelectedRows()]

for chainEntry in chainArray:

chainEntry.toggleEnabled()

selfExtender._selectedColumn = -1

selfExtender._chainTable.redrawTable()

class actionRemoveMessage(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

indexes = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)._index]

else:

indexes = [selfExtender._db.getMessageByRow(rowNum)._index for rowNum in selfExtender._messageTable.getSelectedRows()]

for i in indexes:

selfExtender._db.deleteMessage(i)

selfExtender._selectedColumn = -1

selfExtender._messageTable.redrawTable()

selfExtender._chainTable.redrawTable()

class actionRemoveUser(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._userTable.getSelectedRows():

indexes = [selfExtender._db.getUserByRow(selfExtender._selectedRow)._index]

else:

indexes = [selfExtender._db.getUserByRow(rowNum)._index for rowNum in selfExtender._userTable.getSelectedRows()]

for i in indexes:

selfExtender._db.deleteUser(i)

selfExtender._selectedColumn = -1

selfExtender._userTable.redrawTable()

selfExtender._chainTable.redrawTable()

class actionRemoveChain(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._chainTable.getSelectedRows():

indexes = [selfExtender._db.getChainByRow(selfExtender._selectedRow)._index]

else:

indexes = [selfExtender._db.getChainByRow(rowNum)._index for rowNum in selfExtender._chainTable.getSelectedRows()]

for i in indexes:

selfExtender._db.deleteChain(i)

selfExtender._selectedColumn = -1

selfExtender._chainTable.redrawTable()

class actionRemoveColumn(ActionListener):

def __init__(self, table):

self._table = table

def actionPerformed(self,e):

if selfExtender._selectedColumn >= 0:

if self._table == "u":

# Delete Role

if selfExtender._selectedColumn >= selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT + selfExtender._db.headerCount + selfExtender._db.arrayOfSVs.size():

selfExtender._db.deleteRole(selfExtender._db.getRoleByColumn(

selfExtender._selectedColumn, self._table)._index)

# Delete SV

elif selfExtender._selectedColumn >= selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT + selfExtender._db.headerCount:

selfExtender._db.deleteSV(selfExtender._selectedColumn-(selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT+selfExtender._db.headerCount))

# Delete Header

elif selfExtender._selectedColumn >= selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT:

selfExtender._db.deleteHeader(selfExtender._selectedColumn-selfExtender._db.STATIC_USER_TABLE_COLUMN_COUNT)

elif self._table == "m":

# Delete Role

selfExtender._db.deleteRole(selfExtender._db.getRoleByColumn(

selfExtender._selectedColumn, self._table)._index)

selfExtender._selectedColumn = -1

selfExtender._userTable.redrawTable()

selfExtender._messageTable.redrawTable()

selfExtender._chainTable.redrawTable()

class actionToggleRegex(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

messages = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)]

else:

messages = [selfExtender._db.getMessageByRow(rowNum) for rowNum in selfExtender._messageTable.getSelectedRows()]

for m in messages:

m.setFailureRegex(not m.isFailureRegex())

m.clearResults()

selfExtender._selectedColumn = -1

selfExtender._messageTable.redrawTable()

class actionChangeRegexes(ActionListener):

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

messages = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)]

else:

messages = [selfExtender._db.getMessageByRow(rowNum) for rowNum in selfExtender._messageTable.getSelectedRows()]

newRegex,failureRegex = selfExtender.changeRegexPopup()

if newRegex:

for message in messages:

message._regex = newRegex

message.setFailureRegex(failureRegex)

# Add to list of regexes if its not already there

if newRegex not in selfExtender._db.arrayOfRegexes:

selfExtender._db.arrayOfRegexes.append(newRegex)

selfExtender._selectedColumn = -1

selfExtender._messageTable.redrawTable()

class actionChangeDomain(ActionListener):

def replaceDomain(self, requestResponse, newDomain):

requestInfo = selfExtender._helpers.analyzeRequest(requestResponse)

reqBody = requestResponse.getRequest()[requestInfo.getBodyOffset():]

newHeaders = ModifyMessage.getNewHeaders(requestInfo, None, ["Host: "+newDomain])

newreq = selfExtender._helpers.buildHttpMessage(newHeaders, reqBody)

return newreq

def actionPerformed(self,e):

if selfExtender._selectedRow >= 0:

if selfExtender._selectedRow not in selfExtender._messageTable.getSelectedRows():

messages = [selfExtender._db.getMessageByRow(selfExtender._selectedRow)]

else:

messages = [selfExtender._db.getMessageByRow(rowNum) for rowNum in selfExtender._messageTable.getSelectedRows()]

# Autofill the service values if they are all the same

uniqueServices = [(message._requestResponse.getHttpService().getHost(),

message._requestResponse.getHttpService().getPort(),

message._requestResponse.getHttpService().getProtocol()) for message in messages]

service = None if len(set(uniqueServices)) != 1 else messages[0]._requestResponse.getHttpService()

ok, host, port, tls, replaceHost = selfExtender.changeDomainPopup(service)

if ok and host:

if not port or not port.isdigit():

port = 443 if tls else 80

for m in messages:

if replaceHost:

request = self.replaceDomain(m._requestResponse, host)

else:

request = m._requestResponse.getRequest()

# TODO save the Response?

m._requestResponse = RequestResponseStored(selfExtender, host, int(port), "https" if tls else "http", request)

m.clearResults()

selfExtender._selectedColumn = -1

selfExtender._messageTable.redrawTable()

# Message Table popups

messagePopup = JPopupMenu()

addPopup(self._messageTable,messagePopup)

toggleEnabled = JMenuItem("Disable/Enable Request(s)")

toggleEnabled.addActionListener(actionToggleEnableMessage())

messagePopup.add(toggleEnabled)

messageRun = JMenuItem("Run Request(s)")

messageRun.addActionListener(actionRunMessage())

messagePopup.add(messageRun)

toggleRegex = JMenuItem("Toggle Regex Mode (Success/Failure)")

toggleRegex.addActionListener(actionToggleRegex())

messagePopup.add(toggleRegex)

changeRegex = JMenuItem("Change Regexes")

changeRegex.addActionListener(actionChangeRegexes())

messagePopup.add(changeRegex)

changeDomain = JMenuItem("Change Target Domain")

changeDomain.addActionListener(actionChangeDomain())

messagePopup.add(changeDomain)

messageRemove = JMenuItem("Remove Request(s)")

messageRemove.addActionListener(actionRemoveMessage())

messagePopup.add(messageRemove)

messageHeaderPopup = JPopupMenu()

addPopup(self._messageTable.getTableHeader(),messageHeaderPopup)

roleRemoveFromMessageTable = JMenuItem("Remove Role")

roleRemoveFromMessageTable.addActionListener(actionRemoveColumn("m"))

messageHeaderPopup.add(roleRemoveFromMessageTable)

# User Table popup

userPopup = JPopupMenu()

addPopup(self._userTable,userPopup)

toggleEnabled = JMenuItem("Disable/Enable User(s)")

toggleEnabled.addActionListener(actionToggleEnableUser())

userPopup.add(toggleEnabled)

userRemove = JMenuItem("Remove Users(s)")

userRemove.addActionListener(actionRemoveUser())

userPopup.add(userRemove)

userHeaderPopup = JPopupMenu()

addPopup(self._userTable.getTableHeader(),userHeaderPopup)

removeColumnFromUserTable = JMenuItem("Remove")

removeColumnFromUserTable.addActionListener(actionRemoveColumn("u"))

userHeaderPopup.add(removeColumnFromUserTable)

# Chain Table popup

chainPopup = JPopupMenu()

addPopup(self._chainTable,chainPopup)

toggleEnabled = JMenuItem("Disable/Enable Chain(s)")

toggleEnabled.addActionListener(actionToggleEnableChain())

chainPopup.add(toggleEnabled)

chainRemove = JMenuItem("Remove Chain(s)")

chainRemove.addActionListener(actionRemoveChain())

chainPopup.add(chainRemove)

# request tabs added to this tab on click in message table

self._tabs = JTabbedPane()

# Add change listener to set currentDisplayedItem

class TabChangeListener(ChangeListener):

def stateChanged(self, e):

if type(e.getSource()) == JTabbedPane and e.getSource().getSelectedIndex()>=0:

selfExtender._currentlyDisplayedItem = e.getSource().getSelectedComponent()._requestResponse

self._tabs.addChangeListener(TabChangeListener())

# Button pannel

buttons = JPanel()

self._runButton = JButton("Run", actionPerformed=self.runClick)

self._cancelButton = JButton("Cancel", actionPerformed=self.cancelClick)

self._newUserButton = JButton("New User", actionPerformed=self.getInputUserClick)

self._newRoleButton = JButton("New Role", actionPerformed=self.getInputRoleClick)

self._newHeaderButton = JButton("New Header", actionPerformed=self.newHeaderClick)

self._newChainButton = JButton("New Chain", actionPerformed=self.newChainClick)

self._newStaticValueButton = JButton("New Chain Source", actionPerformed=self.newStaticValueClick)

self._saveButton = JButton("Save", actionPerformed=self.saveClick)

self._loadButton = JButton("Load", actionPerformed=self.loadClick)

self._clearButton = JButton("Clear", actionPerformed=self.clearClick)

buttons.add(self._runButton)

buttons.add(self._cancelButton)

self._cancelButton.setEnabled(False)

separator1 = JSeparator(SwingConstants.VERTICAL)

separator1.setPreferredSize(Dimension(25,0))

buttons.add(separator1)

buttons.add(self._newUserButton)

buttons.add(self._newRoleButton)

buttons.add(self._newHeaderButton)

separator2 = JSeparator(SwingConstants.VERTICAL)

separator2.setPreferredSize(Dimension(25,0))

buttons.add(separator2)

buttons.add(self._newChainButton)

buttons.add(self._newStaticValueButton)

separator3 = JSeparator(SwingConstants.VERTICAL)

separator3.setPreferredSize(Dimension(25,0))

buttons.add(separator3)

buttons.add(self._saveButton)

buttons.add(self._loadButton)

buttons.add(self._clearButton)

# Top pane

firstPane = JSplitPane(JSplitPane.VERTICAL_SPLIT,roleScrollPane,messageScrollPane)

self._topPane = JSplitPane(JSplitPane.VERTICAL_SPLIT, firstPane, chainScrollPane)

bottomPane = JSplitPane(JSplitPane.VERTICAL_SPLIT, self._tabs, buttons)

# Main Pane

self._splitpane = JSplitPane(JSplitPane.VERTICAL_SPLIT, self._topPane, bottomPane)

# customize our UI components

callbacks.customizeUiComponent(self._splitpane)

callbacks.customizeUiComponent(firstPane)

callbacks.customizeUiComponent(self._topPane)

callbacks.customizeUiComponent(bottomPane)

callbacks.customizeUiComponent(messageScrollPane)

callbacks.customizeUiComponent(roleScrollPane)

callbacks.customizeUiComponent(chainScrollPane)

callbacks.customizeUiComponent(self._messageTable)

callbacks.customizeUiComponent(self._userTable)

callbacks.customizeUiComponent(self._chainTable)

callbacks.customizeUiComponent(self._tabs)

callbacks.customizeUiComponent(buttons)

self._splitpane.setResizeWeight(0.5)

firstPane.setResizeWeight(0.35)

self._topPane.setResizeWeight(0.85)

bottomPane.setResizeWeight(0.95)

# Handles checkbox, regex, and enabled coloring

# Must be bellow the customizeUiComponent calls

self._messageTable.setDefaultRenderer(Boolean, SuccessBooleanRenderer(self._messageTable.getDefaultRenderer(Boolean), self._db))

self._messageTable.setDefaultRenderer(str, RegexRenderer(self._messageTable.getDefaultRenderer(str), self._db))

self._userTable.setDefaultRenderer(str, UserEnabledRenderer(self._userTable.getDefaultRenderer(str), self._db))

self._userTable.setDefaultRenderer(Boolean, UserEnabledRenderer(self._userTable.getDefaultRenderer(Boolean), self._db))

self._chainTable.setDefaultRenderer(str, ChainEnabledRenderer(self._chainTable.getDefaultRenderer(str), self._db))

# add the custom tab to Burp's UI

callbacks.addSuiteTab(self)

# register SendTo option

callbacks.registerContextMenuFactory(self)

return

##

## implement ITab

##

def getTabCaption(self):

return "AuthMatrix"

def getUiComponent(self):

return self._splitpane

def highlightTab(self):

currentPane = self._splitpane

previousPane = currentPane

while currentPane and not isinstance(currentPane, JTabbedPane):

previousPane = currentPane

currentPane = currentPane.getParent()

if currentPane:

index = currentPane.indexOfComponent(previousPane)

# TODO use old background instead of black (currently doesnt work)

#oldBackground = currentPane.getBackgroundAt(index)

currentPane.setBackgroundAt(index,self._db.BURP_ORANGE)

class setColorBackActionListener(ActionListener):

def actionPerformed(self, e):

currentPane.setBackgroundAt(index,Color.BLACK)

timer = Timer(5000, setColorBackActionListener())

timer.setRepeats(False)

timer.start()

##

## Creates the sendto tab in other areas of Burp

##

def createMenuItems(self, invocation):

def addRequestsToTab(e):

for messageInfo in messages:

requestInfo = self._helpers.analyzeRequest(messageInfo)

name = str(requestInfo.getMethod()).ljust(8) + requestInfo.getUrl().getPath()

# Grab regex from response

regex = "^HTTP/1\\.1 200 OK"

response = messageInfo.getResponse()

if response:

responseInfo=self._helpers.analyzeResponse(response)

if len(responseInfo.getHeaders()):

responseCodeHeader = responseInfo.getHeaders()[0]

regex = "^"+re.escape(responseCodeHeader)

# Must create a new RequestResponseStored object since modifying the original messageInfo

# from its source (such as Repeater) changes this saved object. MessageInfo is a reference, not a copy

messageIndex = self._db.createNewMessage(RequestResponseStored(self,requestResponse=messageInfo), name, regex)

self._messageTable.redrawTable()

self._chainTable.redrawTable()

self.highlightTab()

class UserCookiesActionListener(ActionListener):

def __init__(self, currentUser, extender):

self.currentUser=currentUser

self.extender = extender

def actionPerformed(self, e):

for messageInfo in messages:

cookieVal = ""

requestInfo = self.extender._helpers.analyzeRequest(messageInfo)

for header in requestInfo.getHeaders():

cookieStr = "Cookie: "

if header.startswith(cookieStr):

cookieVal = header[len(cookieStr):]

# Grab Set-Cookie headers from the responses as well

response = messageInfo.getResponse()

if response:

responseInfo = self.extender._helpers.analyzeResponse(response)

responseCookies = responseInfo.getCookies()

newCookies = "; ".join([x.getName()+"="+x.getValue() for x in responseCookies])

cookieVal = ModifyMessage.cookieReplace(cookieVal,newCookies)

self.currentUser._cookies = cookieVal

self.extender._userTable.redrawTable()

self.extender.highlightTab()

ret = []

messages = invocation.getSelectedMessages()

# Check if the messages in the target tree have a response

valid = True

if invocation.getInvocationContext() == invocation.CONTEXT_TARGET_SITE_MAP_TREE:

for selected in messages:

if not selected.getResponse():

valid = False

if valid:

menuItem = JMenuItem("Send request(s) to AuthMatrix");

menuItem.addActionListener(addRequestsToTab)

ret.append(menuItem)

if len(messages)==1:

# Send cookies to user:

for user in self._db.getUsersInOrderByRow():

menuItem = JMenuItem("Send cookies to AuthMatrix user: "+user._name);

menuItem.addActionListener(UserCookiesActionListener(user, self))

ret.append(menuItem)

return ret

##

## implement IMessageEditorController

## this allows our request/response viewers to obtain details about the messages being displayed

##

def getHttpService(self):

return self._currentlyDisplayedItem.getHttpService()

def getRequest(self):

return self._currentlyDisplayedItem.getRequest()

def getResponse(self):

return self._currentlyDisplayedItem.getResponse()

##

## Actions on Bottom Row Button Clicks

##

def getInputUserClick(self, e):

newUser = JOptionPane.showInputDialog(self._splitpane,"Enter New User:")

if newUser:

self._db.getOrCreateUser(newUser)

self._userTable.redrawTable()

# redraw Message Table since it adds a new SingleUser Role

self._messageTable.redrawTable()

self._chainTable.redrawTable()

def getInputRoleClick(self, e):

newRole = JOptionPane.showInputDialog(self._splitpane,"Enter New Role:")

if newRole:

self._db.getOrCreateRole(newRole)

self._userTable.redrawTable()

self._messageTable.redrawTable()

def newChainClick(self,e):

self._db.createNewChain()

self._chainTable.redrawTable()

def newHeaderClick(self, e):

self._db.addNewHeader()

self._userTable.redrawTable()

def newStaticValueClick(self, e):

newSV = JOptionPane.showInputDialog(self._splitpane,"Enter a label for the new Chain Source:")

if newSV:

self._db.addNewSV(newSV)

self._userTable.redrawTable()

self._chainTable.redrawTable()

def cancelClick(self,e):

self._runCancelled = True

self._cancelButton.setEnabled(False)

def saveClick(self, e):

# Update original requests with any user changes

self._messageTable.updateMessages()

returnVal = self._fc.showSaveDialog(self._splitpane)

if returnVal == JFileChooser.APPROVE_OPTION:

f = self._fc.getSelectedFile()

if f.exists():

result = JOptionPane.showConfirmDialog(self._splitpane, "The file exists, overwrite?", "Existing File", JOptionPane.YES_NO_OPTION)

if result != JOptionPane.YES_OPTION:

return

fileName = f.getPath()

# TODO Potential bug here. Check if the value being written is 0 before opening

# TODO add a try catch here?

jsonValue = self._db.getSaveableJson()

if jsonValue:

fileout = open(fileName,'w')

fileout.write(jsonValue)

fileout.close()

else:

# TODO popup errors instead of prints

print "Error: Save Failed. JSON empty."

# TODO currently this will save the config to burp, but not to a specific project

# Will also need an export and loadFromFile feature if this is ever implemented

# self._callbacks.saveExtensionSetting("AUTHMATRIX", self._db.getSaveableJson())

def loadClick(self,e):

returnVal = self._fc.showOpenDialog(self._splitpane)

if returnVal == JFileChooser.APPROVE_OPTION:

f = self._fc.getSelectedFile()

fileName = f.getPath()

filein = open(fileName,'r')

jsonText = filein.read()

filein.close()

# Check if using on older state file compatible with v0.5.2 or greater

if not jsonText or jsonText[0] !="{":

warning = """

result = JOptionPane.showOptionDialog(self._splitpane,

warning, "Caution",

JOptionPane.YES_NO_OPTION,

JOptionPane.WARNING_MESSAGE,

None,

["OK", "Cancel"],

"OK")

if result != JOptionPane.YES_OPTION:

return

self._db.loadLegacy(fileName,self)

else:

self._db.loadJson(jsonText,self)

# TODO currently can load exention settings, but this is saved for Burp and not for the Project specifically

# self._db.loadJson(self._callbacks.loadExtensionSetting("AUTHMATRIX"),self)

self._userTable.redrawTable()

self._messageTable.redrawTable()

self._chainTable.redrawTable()

def clearClick(self,e):

result = JOptionPane.showConfirmDialog(self._splitpane, "Clear AuthMatrix Configuration?", "Clear Config", JOptionPane.YES_NO_OPTION)

if result == JOptionPane.YES_OPTION:

self._db.clear()

self._tabs.removeAll()

self._userTable.redrawTable()

self._messageTable.redrawTable()

self._chainTable.redrawTable()

def runClick(self,e):

t = Thread(target=self.runMessagesThread)

self._tabs.removeAll()

t.start()

def changeRegexPopup(self):

regexComboBox = JComboBox(self._db.arrayOfRegexes)

regexComboBox.setEditable(True)

failureModeCheckbox = JCheckBox()

panel = JPanel(GridBagLayout())

gbc = GridBagConstraints()

gbc.anchor = GridBagConstraints.WEST

firstline = JPanel()

firstline.add(JLabel("Select a Regex for all selected Requests:"))

secondline = JPanel()

secondline.add(regexComboBox)

thirdline = JPanel()

thirdline.add(failureModeCheckbox)

thirdline.add(JLabel("Regex Detects Unauthorized Requests (Failure Mode)"))

gbc.gridy = 0

panel.add(firstline,gbc)

gbc.gridy = 1

panel.add(secondline, gbc)

gbc.gridy = 2

panel.add(thirdline, gbc)

result = JOptionPane.showConfirmDialog(self._splitpane, panel, "Select Response Regex", JOptionPane.OK_CANCEL_OPTION)

value = regexComboBox.getSelectedItem()

if result == JOptionPane.CANCEL_OPTION or not value:

return None, None

return value, failureModeCheckbox.isSelected()

def changeDomainPopup(self, service):

hostField = JTextField(25)

portField = JTextField(25)

checkbox = JCheckBox()

replaceHostCheckbox = JCheckBox()

replaceHostCheckbox.setSelected(True)

errorField = JLabel("\n")

errorField.setForeground(Color.orange);

errorField.setFont

def isValidDomain(domain):

return re.match(r'^[a-zA-Z0-9-\.]+$', domain)

if service:

hostField.setText(service.getHost())

portField.setText(str(service.getPort()))

if service.getProtocol()=="https":

checkbox.setSelected(True)

class HttpsItemListener(ItemListener):

def itemStateChanged(self, e):

if e.getStateChange() == ItemEvent.SELECTED and portField.getText() == "80":

portField.setText("443")

elif e.getStateChange() == ItemEvent.DESELECTED and portField.getText() == "443":

portField.setText("80")

checkbox.addItemListener(HttpsItemListener())

class HostDocumentListener(DocumentListener):

def changeUpdate(self, e):

self.testHost()

def removeUpdate(self, e):

self.testHost()

def insertUpdate(self, e):

self.testHost()

def testHost(self):

domain = hostField.getText()

matches = isValidDomain(domain)

if not matches:

# NOTE Hacky way to fix layout when host is long

if len(domain)>40:

domain = domain[:40]+"..."

errorField.setText("Invalid host: "+domain)

else:

errorField.setText("\n")

hostField.getDocument().addDocumentListener(HostDocumentListener())

domainPanel = JPanel(GridBagLayout())

gbc = GridBagConstraints()

gbc.anchor = GridBagConstraints.WEST

firstline = JPanel()

firstline.add(JLabel("Specify the details of the server to which the request will be sent."))

secondline = JPanel()

secondline.add(JLabel("Host: "))

secondline.add(hostField)

thirdline = JPanel()

thirdline.add(JLabel("Port: "))

thirdline.add(portField)

fourthline = JPanel()

fourthline.add(checkbox)

fourthline.add(JLabel("Use HTTPS"))

fifthline = JPanel()

fifthline.add(replaceHostCheckbox)

fifthline.add(JLabel("Replace Host in HTTP header"))

sixthline = JPanel()

sixthline.add(errorField)

gbc.gridy = 0

domainPanel.add(firstline,gbc)

gbc.gridy = 1

domainPanel.add(secondline, gbc)

gbc.gridy = 2

domainPanel.add(thirdline, gbc)

gbc.gridy = 3

domainPanel.add(fourthline, gbc)

gbc.gridy = 4

domainPanel.add(fifthline, gbc)

gbc.gridy = 5

domainPanel.add(sixthline, gbc)

result = JOptionPane.showConfirmDialog(

self._splitpane,domainPanel, "Configure target details", JOptionPane.OK_CANCEL_OPTION)

cancelled = (result == JOptionPane.CANCEL_OPTION)

if cancelled or not isValidDomain(hostField.getText()):

return (False, None, None, False, False)

return (True, hostField.getText(), portField.getText(), checkbox.isSelected(), replaceHostCheckbox.isSelected())

##

## Methods for running messages and analyzing results

##

def lockButtons(self, running=True):

# Disable run button, enable cancel button

self._runButton.setEnabled(not running)

self._newUserButton.setEnabled(not running)

self._newRoleButton.setEnabled(not running)

self._newHeaderButton.setEnabled(not running)

self._newChainButton.setEnabled(not running)

self._newStaticValueButton.setEnabled(not running)

self._saveButton.setEnabled(not running)

self._loadButton.setEnabled(not running)

self._clearButton.setEnabled(not running)

self._cancelButton.setEnabled(running)

def runMessagesThread(self, messageIndexes=None):

self._db.lock.acquire()

try:

self.lockButtons()

self._runCancelled=False

# Update original requests with any user changes

self._messageTable.updateMessages()

self._db.clearAllChainResults()

indexes = messageIndexes

if not indexes:

indexes = self._db.getActiveMessageIndexes()

self.clearColorResults(indexes)

# Run in order of row, not by index

messagesThatHaveRun = []

for message in self._db.getMessagesInOrderByRow():

# Only run if message is in the selected indexes (NOTE: dependencies will be run even if not selected)

if message._index in indexes:

messagesThatHaveRun = self.runMessageAndDependencies(message._index, messagesThatHaveRun, [])

except:

traceback.print_exc(file=self._callbacks.getStderr())

finally:

self.lockButtons(False)

self._db.lock.release()

self._messageTable.redrawTable()

def runMessageAndDependencies(self, messageIndex, messagesThatHaveRun, recursionCheckArray):

messageEntry = self._db.arrayOfMessages[messageIndex]

updatedMessagesThatHaveRun = messagesThatHaveRun[:]

updatedRecursionCheckArray = recursionCheckArray[:]

if messageIndex in updatedRecursionCheckArray:

print "Error: Recursion detected in message chains: "+"->".join([str(i) for i in updatedRecursionCheckArray])+"->"+str(messageIndex)

elif (messageIndex not in updatedMessagesThatHaveRun

and messageEntry.isEnabled()

and messageIndex in self._db.getActiveMessageIndexes()):

updatedRecursionCheckArray.append(messageIndex)

for chainIndex in self._db.getActiveChainIndexes():

# Run any dependencies first

chainEntry = self._db.arrayOfChains[chainIndex]

if (messageIndex in chainEntry.getToIDRange()

and chainEntry.isEnabled()

and str(chainEntry._fromID).isdigit()

and int(chainEntry._fromID) >= 0):

updatedMessagesThatHaveRun = self.runMessageAndDependencies(int(chainEntry._fromID), updatedMessagesThatHaveRun, updatedRecursionCheckArray)

self.runMessage(messageIndex)

# print messageIndex

updatedMessagesThatHaveRun.append(messageIndex)

return updatedMessagesThatHaveRun

def runMessage(self, messageIndex):

# NOTE: this uses hacky threading tricks for handling timeouts

tempRequestResponse = []

index = 0

def loadRequestResponse(index, service, message):

# NOTE: tempRequestResponse is an array because of a threading issue,

# where if this thread times out, it will still update temprequestresponse later on..

try:

tempRequestResponse[index] = self._callbacks.makeHttpRequest(service,message)

except java.lang.RuntimeException:

# Catches if there is a bad host

# TODO there may sometimes be an unhandled exception thrown in the stack trace here?

print "Runtime Exception"

return

except:

traceback.print_exc(file=callbacks.getStderr())

messageEntry = self._db.arrayOfMessages[messageIndex]

messageEntry.clearResults()

messageInfo = messageEntry._requestResponse

requestInfo = self._helpers.analyzeRequest(messageInfo)

reqBody = messageInfo.getRequest()[requestInfo.getBodyOffset():]

for userIndex in [userEntry._index for userEntry in self._db.getUsersInOrderByRow()]:

# Handle cancel button early exit here

if self._runCancelled:

return

userEntry = self._db.arrayOfUsers[userIndex]

# Only run if the user is enabled

if userEntry.isEnabled():

newHeaders = ModifyMessage.getNewHeaders(requestInfo, userEntry._cookies, userEntry._headers)

newBody = reqBody

# Replace with Chain

for toValue, chainIndex in userEntry.getChainResultByMessageIndex(messageIndex):

# Add transformers

chain = self._db.arrayOfChains[chainIndex]

toValue = chain.transform(toValue, self._callbacks)

toRegex = chain._toRegex

newBody = StringUtil.toBytes(ModifyMessage.chainReplace(toRegex,toValue,[StringUtil.fromBytes(newBody)])[0])

newHeaders = ModifyMessage.chainReplace(toRegex,toValue,newHeaders)

# Replace with SV

# toValue = SV, toRegex = toRegex

for chain in [self._db.arrayOfChains[i] for i in self._db.getActiveChainIndexes()]:

svName = chain.getSVName()

# If the Chain Source exists, and this message is affected, and the chain is enabled

if svName and messageIndex in chain.getToIDRange() and chain.isEnabled():