description: 分析burpsuite官方提供的示例代码，以此来学习插件编写。

HelloWorld

废话不多说，直接上代码！

from burp import IBurpExtender
from java.io import PrintWriter
from java.lang import RuntimeException

# 上面import的第一句是所有burp插件都必须有的
# 下面开始创建一个burp插件的类来实现插件
class BurpExtender(IBurpExtender):
    def registerExtenderCallbacks(self, callbacks):
        # 创建插件名
        callbacks.setExtensionName("HelloWorld extension")
        # 获取输出和错误流
        stdout = PrintWriter(callbacks.getStdout(), True)
        stderr = PrintWriter(callbacks.getStderr(), True)
        # 在输出流和错误流中插入消息
        stdout.println("Hello output")
        stderr.println("Hello errors")
        # 将消息插入burp的alert警报标签中
        callbacks.issueAlert("Hello alerts")
        # 抛出将出现在错误流中的异常
        raise RuntimeException("Hello exception")

现在开始来说几个坑：
1、插件最好尽量放在英文路径，不然可能会报错
2、编写代码前指定编码(如：# -- coding:utf8 --)
3、raise RuntimeException("Hello exception") 这行代码我没看懂是要干嘛的，反正写了之后Errors就报错，不想看的话就注释掉好了。

event_listeners 事件监听器

#!/usr/bin/python3
# -*- coding:utf-8 -*-

from burp import IBurpExtender
from burp import IHttpListener
from burp import IProxyListener
from burp import IScannerListener
from burp import IExtensionStateListener
from java.io import PrintWriter

class BurpExtender(IBurpExtender, IHttpListener, IProxyListener, IScannerListener, IExtensionStateListener):
    def registerExtenderCallbacks(self, callbacks):
        # 保持对回调对象的引用
        self._callbacks = callbacks
        # 创建插件名
        callbacks.setExtensionName("Event Listeners")
        # 获取输出流
        self._stdout = PrintWriter(callbacks.getStdout(), True)
        # 注册为http监听器
        callbacks.registerHttpListener(self)
        # 注册为proxy监听器
        callbacks.registerProxyListener(self)
        # 注册为scanner监听器
        callbacks.registerScannerListener(self)
        # 注册为扩展插件状态监听器
        callbacks.registerExtensionStateListener(self)
    # 下面几个函数各自实现监听
    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
        self._stdout.println(
            ("HTTP request to " if messageIsRequest else "HTTP response from") +
            messageInfo.getHttpService().toString() +
            "[" + self._callbacks.getToolName(toolFlag) + "]"
        )

    def processProxyMessage(self, messageIsRequest, message):
        self._stdout.println(
            ("Proxy request to " if messageIsRequest else "Proxy response from") +
            message.getMessageInfo.getHTTPService().toString()
        )

    def newScanIssue(self, issue):
        self._stdout.prinln("New scan issue " + issue.getIssueName())

    def extensionUnloaded(self):
        self._stdout.println("Extension was unloaded")

我是没搞懂这个插件做了什么，诶无所谓，也就是多敲敲代码，熟悉熟悉感觉。

traffic_redirector 流量重定向

#!/usr/bin/python3
# -*- coding:utf-8 -*-

from burp import IBurpExtender
from burp import IHttpListener

HOST_FROM = "www.baidu.com"
HOST_TO = "www.zhihu.com"

class BurpExtender(IBurpExtender, IHttpListener):
    def registerExtenderCallbacks(self, callbacks):
        # 获取扩展helpers对象
        self._helpers = callbacks.getHelpers()
        # 设置扩展名
        callbacks.setExtensionName("Traffic redirector")
        # 将自己注册为HTTP侦听器
        callbacks.registerHttpListener(self)

    def processHttpMessage(self, toolsFlag, messageIsRequest, messageInfo):
        # 只获取请求
        if not messageIsRequest:
            return
        # 获取http服务的请求
        httpService = messageInfo.getHttpService()
        # 如果主机是HOST_FROM则将它改成HOST_TO
        if (HOST_FROM == httpService.getHost()):
            messageInfo.setHttpService(self._helpers.buildHttpService(HOST_TO,
                httpService.getPort(), httpService.getProtocol()))

这个插件简单来说就是，把请求中的host部分修改掉。比如上述代码会监听所有host为百度的请求，一旦出现，就会把host改成知乎。