Skip to content

Instantly share code, notes, and snippets.

@nvssks
Created July 12, 2019 11:22
Show Gist options
  • Save nvssks/9e57a88495c797135171466935614a7f to your computer and use it in GitHub Desktop.
Save nvssks/9e57a88495c797135171466935614a7f to your computer and use it in GitHub Desktop.
This Burp plugin will sync the X-XSRF-TOKEN with the value in the XSRF-TOKEN cookie
from burp import IBurpExtender
from burp import ISessionHandlingAction
from burp import IBurpExtenderCallbacks
class BurpExtender(IBurpExtender, ISessionHandlingAction):
def registerExtenderCallbacks(self, callbacks):
self._callbacks = callbacks
self._helpers = self._callbacks.getHelpers()
self._callbacks.setExtensionName('CSRF Syncro Header')
self._callbacks.registerSessionHandlingAction(self)
print '[*] CSRF Syncro'
def getActionName(self):
return 'CSRF Syncro'
def performAction(self, currentRequest, macroItems):
request=currentRequest.getRequest()
request_info=self._helpers.analyzeRequest(request)
cookie_parameter=self._helpers.getRequestParameter(request,'XSRF-TOKEN')
if cookie_parameter:
headers=request_info.getHeaders()
for head in headers:
if 'X-XSRF-TOKEN' in head:
headers.remove(head)
break #concurent modification error if let continue
cookie_value=cookie_parameter.getValue()
headers.add('X-XSRF-TOKEN: ' + cookie_value)
print "[+] Header Updated to: " + cookie_value
new_request = self._helpers.buildHttpMessage(headers, request[request_info.getBodyOffset():])
currentRequest.setRequest(new_request)
else:
print '[-] Parameter missing'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment