Skip to content
A Burp Suite extension which performs checks for cross-domain scripting against the DOM, subresource integrity checks, and evaluates JavaScript resources against threat intelligence data.
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
gradle/wrapper
intel
src
.gitignore
LICENSE
README.md
build-plugin.sh
build.gradle
gradlew
gradlew.bat
javascript-security-extension-all-1.0.jar
run-tests.sh
settings.gradle
tests.gradle

README.md

JavaScript Security Burp Extension

This is a burp extension which adds passive checks to the Burp scanner. The following is a list of items it will look for:

  • Cross-Domain Script Includes (DOM)
  • JavaScript Missing Subresource Integrity Attributes
  • CORS Headers Do Not Require Subresource Integrity
  • Malicious/Vulnerable JavaScript Includes
  • Subresource Integrity Failed Validation
  • Cross-Domain Script Includes where DNS Resolution Fails

It does this by looking at the HTML received and loads the DOM via a headless Chromium instance using Selenium.

Licensing and Recognition

Distributed under GPLv3. Copyright 2019: Focal Point Data Risk, LLC Written by: Peter Hefley

Installation

  1. Obtain a copy of this repo.
  2. Install the chromedriver shim between selenium and chromium. On Ubuntu, this is done by issuing the following command: sudo apt install chromium-chromedriver
  3. In burp, go to the extender tab, extensions sub-tab, and Add this extension. It is a Java extension type and you will need to select the included, or built, jar file.

Configuration

A "JavaScript Security" tab will appear in your burp session which allows you to configure two things:

  • The path to the chromedriver binary you want to use. This defaults to the standard location it is installed to in Linux.
  • The delay before evaluating the DOM (in seconds). As all of the JavaScript is gathered and run, the DOM may change over time. For advanced pages or slow connections, you might want to bump this up, but passive scans will take longer. The default, which I've had luck with, is 10 seconds.

It is possible to load indicators of compromise (IOCs) as JSON files through the GUI tab. Examples are provided in the intel folder.

Execution

When you run passive checks, the checks installed will run. Any output or errors will appear on the Extender/Extensions tab under "JavaScript Security -- SRI and Threat Intel".

Requirements

  1. watch the DOM (not "html") and log every loaded JS as a finding (medium?). totally ignore scope
  2. check every loaded js against a list of known compromised and make different alert
  3. profit
  4. When you can't load a JS resource, check to see if the domain is available.

Known Issues

I've seen weird caching issues with systemd-resolved, the default DNS service on Ubuntu. If you see resources which cannot be accessed due to DNS issues, consider disabling the DNS caching or clearing your cache. Both seem to help.

/etc/systemd > cat resolved.conf | grep "Cache" Cache=no

References

You can’t perform that action at this time.