Un1kHacking

Security: C-1

Publish Time: 2026-02-28

Category: Old Posts

Old Version | Diff |

AI Info

📌 AI Point 95

📝 AI Summary 本文是一篇关于BurpSuite插件开发的实战教程，重点介绍了一个用于云函数代理测试的插件实现过程。文章从设计背景出发，指出了现有云函数代理工具的缺陷，并提出简化方案。随后，详细讲解了插件开发的关键步骤，包括HTTP监听器的注册与实现、请求模块的识别、请求与响应的修改、自定义HTTP服务类以重定向流量、原始请求的编码与传递，以及云函数端的请求解析与转发逻辑。最后，文章还探讨了未来可能的改进方向，如动态配置和用户界面优化。全文结合代码示例和实际效果截图，具有很强的实践指导意义。

⭐ AI Evaluation 这是一篇非常优秀的BurpSuite插件开发教程，内容详实、逻辑清晰，技术细节丰富。作者不仅清晰地阐述了插件的设计理念和解决的实际问题，还提供了从代码实现到部署测试的完整流程。文中对关键难点（如`setHttpService`的使用和云函数端请求重建）进行了深入剖析，并配有大量代码片段和截图，极大地方便了读者理解和复现。此外，文章语言通俗易懂，适合初学者入门，同时也为进阶开发者提供了有价值的参考。唯一可以改进的是，若能增加一些异常处理或性能优化方面的讨论，将使内容更加完善。总体而言，这是一篇高质量的技术文章，值得推荐。

Online Users:

## Preface

A plugin designed for quickly integrating cloud function proxy testing. This article also provides a step-by-step development guide from scratch for beginners in BurpSuite plugin development.

## Design Concept

Currently, some cloud function proxy tools only perform traffic forwarding, meaning that when accessing a website, all traffic is routed through your VPS and then forwarded to your cloud function interface. This approach leverages the CDN proxy pool of cloud functions to prevent attack traceability. While this method is feasible, it has several practical drawbacks.

First, the traffic path—traffic→ VPS → cloud function—involves two layers of relay. Second, due to insufficient performance or bandwidth of either the cloud function or the VPS, even accessing fast websites like Baidu can result in full resource loading and cause the system to freeze. Therefore, we can simplify this by extracting only the necessary functionality for use in Repeater.

## Writing the Code

1. Read the official SDK and documentation2. Understand the requirements

The goal is to use the plugin to send HTTP traffic to a cloud function interface for processing when sending HTTP requests in the Repeater module, and then return the response information directly to the response panel. To determine which module is active, BurpSuite's API provides a general method, and modules can be identified using `toolFlag`. Therefore, we need to implement an HTTP request listener.

That is, `IHttpListener`. Before using this interface, you must register an HTTP listener via `IBurpExtenderCallbacks.registerHttpListener()`. Once registered, all HTTP requests and responses will be notified to this listener, allowing you to analyze or modify HTTP data packets within it.

Code example:

![](https://img.meituan.net/imgupload/09142d683795358326fdeeafc6da4c08164656.png)

Note that at the very beginning, the interface must inherit `IHttpListener`:

![](https://img.meituan.net/imgupload/b25e2fa843a95b4d381449fe66efdbfd12595.png)

This interface provides only one method: `processHttpMessage`. This method has three parameters:

![](https://img.meituan.net/imgupload/886ec66a4a6db0cdd50149e2d16a142523865.png)

By checking the `toolFlag` property, we can determine whether the current module is Repeater. The code only takes effect in Repeater:

```
if(toolFlag == 0x00000040) {
 // To do here
}
```

This easily satisfies the first requirement. Next comes forwarding the traffic to the cloud function service interface and canceling the original request. This is the biggest pitfall in development. The method comes with an interface `IHttpRequestResponse`. We need to use this interface to modify the request and set the response. Its methods are as follows:

![](https://img.meituan.net/imgupload/08d3173a72366d0302f7602a528ea7051030645.png)

So initially, we need to use the `setRequest` method to modify the request. Code example:

![](https://img.meituan.net/imgupload/1d75955c3a30e7d755f20b453363f89177920.png)

Although the request is modified, when testing against the domain blog.happysec.cn, regardless of what request code is sent from the Repeater module, the actual request packet is always the one in `bytes`. The effect is that a GET request to `/scf.php?body=` is sent, completely ignoring your original payload.

However, issues arise when testing other domains. Since `setRequest` only modifies the message body of the request, the `service` field (containing host, port, and protocol) remains unchanged—still pointing to the original target like a.com, http, 8081. When the host in the service does not match the host in the request packet, access fails. Therefore, I shifted my focus to the `setHttpService` method. If we use this method to update the host, port, and protocol to match our cloud function details, we can resolve this issue. But since `IHttpService` is an interface and not a concrete object, we need to implement it:

```
class WSHttpService implements IHttpService
```

The `WSHttpService` class must implement all methods of the `IHttpService` interface. Then define three properties and override `getHost`, `getPort`, and `getProtocol`:

private String host;
        private int port;
        private String protocol;

WSHttpService() {
            host = "blog.happysec.cn";
            protocol = "https";
            port = 443;
        }

@Override
        public String getHost() {
            return host;
        }

@Override public int getPort() {
            return port;
        }

@Override
        public String getProtocol() {
            return protocol;
        }

In the class constructor, the three parameters are set to the cloud function’s interface address, port, and protocol by default. Then we instantiate the `WSHttpService` class and use the `setHttpService` method to reset the `service` information in `messageInfo`.

Code example:

WSHttpService iHttpService = new WSHttpService();
            messageInfo.setHttpService(iHttpService);
            IHttpService iHttpService2 = messageInfo.getHttpService();
            this.stdout.println(iHttpService.getHost());
            this.stdout.println(iHttpService.getPort());
            this.stdout.println(iHttpService.getProtocol());

After repackaging the plugin and testing website access:

![](https://img.meituan.net/imgupload/57fbe29c0a713e0022f07d0f348b0e35201624.png)

We find that regardless of the host set in the request packet, the traffic always uses the host, port, and protocol defined in the `WSHttpService` class.

With this issue resolved, the remaining tasks—such as writing the cloud function interface, packaging original request headers, and sending the request to the cloud function—are straightforward.

3. Packaging the Original Request Code

We need to package the original HTTP request message and send it to the cloud function interface. Using the following line:

```
String body = (helpers.bytesToString(messageInfo.getRequest())); // Get request data
```

We can obtain the original request data as a string, i.e.,

![](https://img.meituan.net/imgupload/4bdded238603a17f8f306413304c831439714.png)

the content inside this box.

To prevent encoding errors, we encode the string using Base64:

try {
                    base64encodedString = Base64.getEncoder().encodeToString(body.getBytes("utf-8"));
                } catch (UnsupportedEncodingException e) {
                    e.printStackTrace();
                }

Then we only need to modify the original request accordingly:

![](https://img.meituan.net/imgupload/e12cd2b7fb52a8b902b5e56bb78dc86254197.png)

Now it becomes clear: the purpose of modifying the service earlier was solely to prevent request failures caused by host mismatches.

Then we update the body parameter with our Base64-encoded data.

4. Writing the Cloud Function Code

At this point, the Burp plugin is complete.

Next comes processing the request packet in the cloud function. Extract key parameters such as body, host, URI, method, and content-type from the original request, and use the cloud function to reissue the request.

Note: Since both requests and responses are captured by this listener, we need to set a condition:

![](https://img.meituan.net/imgupload/db13c8f0f8561c8041cce85420077bed10421.png)

By default, do not process incoming responses.

I retrieve the original request using:

String body = (helpers.bytesToString(messageInfo.getRequest())); // Get request packetThen encode `body` with Base64, allowing us to send the original HTTP message to the cloud function interface. Many options exist for implementing the interface; here, I chose PHP.

First, to reissue the original request using the raw HTTP message, one might consider using `socket` to write and send the packet.

However, this approach also has pitfalls. Initially, I used `fsockopen`, but later encountered certificate errors. So I switched to `stream_socket_client` and created an SSL context using `stream_context_create`, setting both `verify_peer_name` and `verify_peer` to `false` to bypass certificate validation. Yet, issues persisted: file uploads failed, some websites returned blank pages, and the problem wasn’t with the cloud function—it was in the code.

Unpredictable errors occurred during the `write` operation. Even after repeatedly diffing the sent and original packets, I couldn’t identify the issue. The interface received what appeared to be identical requests. Eventually, I abandoned this approach and switched to parsing the HTTP message, then using cURL to send the request. The `analyzeRequest` method provides useful utilities like `getUrl` and `getHeaders`, enabling quick retrieval of URL and header information. Note that the first element in the headers list is something like **POST /api HTTP/1.1**. The method can also be obtained via `getMethod`, and the URI is included in the URL. So we can remove the first element from the headers list and Base64-encode the rest before sending to the interface.

With this, issues related to headers, URL, and method are resolved. Next is extracting file content or request parameters from the body. The BurpSuite API does not provide a direct method to get the body content via `analyzeRequest`, but it does offer `getBodyOffset` to retrieve the body’s starting position. Thus, we can obtain the request body with:

```
String sendData = body.substring(reqInfo.getBodyOffset());
```

That is, extract everything from the offset onward—this is the body content. Later, retrieve the value and use `curl_setopt`—no need to elaborate further. Results below (encoding issues resolved):

![](https://img.meinuan.net/imgupload/6bb75f136a1b66668cef7debdc48fb0a241970.png)

![](https://img.meituan.net/imgupload/70af487760c506f002c328ac42e49e41215767.png)

In practice, there’s still room for improvement. For example, the cloud function interface is hardcoded and not dynamically configurable. I considered adding configuration import, but realized it would require building a UI and using a separate loader—too cumbersome. A simpler alternative: create a default `.ini` file in the BurpSuite directory; if it doesn’t exist, prompt the user with a command to load it.

Mac results:

![](https://img.meituan.net/imgupload/d0049def9bce0f4ce5d362b9d35c7046170536.png)
![](https://img.meituan.net/imgupload/84741625f697f03a85b51c4fbd0ce49a673829.png)

Later, add a menu item to enable listening. Suppose I modify the interface in the config file—clicking the menu will reload it.

![](https://img.meituan.net/imgupload/1e5e2c60bd0681572d51c610a1bb5327512587.png)

![](https://img.meituan.net/imgupload/68514ac3537e0d3ccea810149434031d174769.png)

Modify the interface code to include the API host used in the response for easier identification.

![](https://img.meituan.net/imgupload/d52e28d492154acb03bce642e33eb837475595.png)

![](https://img.meituan.net/imgupload/9f8b764c089c14ec6e725fa17f77669b231627.png)

With these steps, the tool is ready for practical use.

本内容由@depybot AI智能助手生成

Comment List [Latest 5]

Comment

AI Assistant Reply

Add @depybot in your content to summon the AI robot for a reply. This action will automatically make your comment public. Do not use it if sensitive information is involved. Contact the site administrator for deletion if needed.

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as Reproduced

Please contact the blogger for authorization to reprint

Un1kHacking

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as ReproducedPlease contact the blogger for authorization to reprint

© Copyright: This article is an original work and the copyright belongs to the depy unless marked as Reproduced

Please contact the blogger for authorization to reprint