yandex / burp-molly-pack

Security checks pack for Burp Suite

Burp-molly-pack

Overview

Burp-molly-pack is Yandex security checks pack for Burp. The main goal of Burp-molly-pack is to extend Burp checks. Plugins contains Active and Passive security checks.

Usage

• Build fat jar with Maven mvn package or download release version
• Change and save burp_molly_config.json
• Put path to config in MOLLY_CONFIG Environment variable

export MOLLY_CONFIG=/path/to/burp_molly_config.json

• Run Burp Suite in console java -jar burpsuite_pro.jar
• Add Plugins Jar file in Extender Tab

Contributing

Contributions to Burp-molly-pack are always welcome! You can help us in different ways:

• Open an issue with suggestions for improvements and errors you're facing;
• Fork this repository and submit a pull request;
• Improve the documentation.

burp-molly-pack's Issues

BurpSuite Getting Crashed while Adding Extension

Hello,

Not sure why am making this again, a few minutes ago I created the issue here, and now it disappears, making again.

Created the build.

While adding extension burp getting crashed and closed as you can see here

Burp crash

Hi,

my Burp is installed on Mac OS, can you explain me please how to use your plugin? Because if I install the jar from extender it crash.

not sure how I can open it using java -jar /Applications/Burp Suite Professional.app because not works. Thank you

SSRF/XXE/HTTP interaction not working on v2.1

I've been testing this extension on 1.7.37 and 2.1 versions.
In version 1.7.37 extension works.
in 2.1 it works but not the active payloads.
I've tested on testphp.vulnweb.com and DSVW (https://github.com/stamparm/DSVW).
With older version the ssrf http/dns interaction are detected, in newer one it doesn't.
Maybe due to API changes, 'cause also active phase of other extensions doesn't works.
Would like a possible update 'cause i don't know well Java (i'll try).
Or someone could help.

Cheers