Burp Extension for a passive scanning JS files for endpoint links.
- Export results the text file
- Exclude specific 'js' files e.g. jquery, google-analytics
Copyright (c) 2019 Frans Hendrik Botes
Credit to https://github.com/GerbenJavado/LinkFinder for the idea and regex
For use with the professional version of Burp Suite. Ensure you have JPython loaded and setup before installing.
You can modify the exclusion list by updating the strings on line 33. Currently any strings that include the included words will not be analysed.
# Needed params
JSExclusionList = ['jquery', 'google-analytics','gpt.js']
Once you've loaded the plugin there is some things to consider. Burp performs threading on passive scanning by itself. This can be controlled by looking at the Scanner options. For quick scanning I make use of the following settings with this plugin:
Scanner --> Live Scanning
- Live Active Scanning : Disabled
- Live Passive Scanning : Use suite scope
As with ALL the burp scanner items, you have to give it a minute or so to work through the data. You shouldn't be waiting several minutes for a result tho.
If the links have been excluded monitor the OUTPUT of the extension under the Extender options to verify.
- Added swing memory management (14/06/2019)
- Added exclusion list on line 33 of code ['jquery', 'google-analytics','gpt.js'] (14/06/2019)
- Added ability to export files (15/06/2019)