Wednesday, November 18, 2009

patch to import_burp.rb

small update to import_burp.rb script from Jonathan Voris to deal with recent changes in burp log format


*** import_burp.rb Mon Oct 26 14:13:09 2009
--- import_burp2.rb Wed Nov 18 10:38:59 2009
***************
*** 51,57 ****
hostRegex = /(http|https)?:\/\/(\S+):(\d+)/
#From http://www.regular-expressions.info/examples.html
ipAddrRegex = /\[(\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)\]/
! methodRegex = /(HEAD|GET|POST|PUT|DELETE|TRACE|OPTIONS|CONNECT) \/([^\?]*)\?*(\S*) /
responseRegex = /^HTTP\/\d.\d (\d\d\d)/

#Open the database file
--- 51,58 ----
hostRegex = /(http|https)?:\/\/(\S+):(\d+)/
#From http://www.regular-expressions.info/examples.html
ipAddrRegex = /\[(\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)\]/
! methodRegex = /(HEAD|GET|POST|PUT|DELETE|TRACE|OPTIONS|CONNECT) .*\/([^\?]*)\?*(\S*) /
! removeJunkRegex = /UTF\-\d+/
responseRegex = /^HTTP\/\d.\d (\d\d\d)/

#Open the database file
***************
*** 193,198 ****
--- 194,202 ----
puts("Skipping this entry: neither the host name nor the IP address match the specified target.")
else
#set the values in the query
+
+ responseBody.gsub!(removeJunkRegex, "")
+
dbQuery.bind_param("host", ipAddr)
dbQuery.bind_param("port", port)
dbQuery.bind_param("ssl", ssl)

No comments: