Add files via upload

pom.xml

@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.github.pmiaowu</groupId>
+    <artifactId>BurpShiroPassiveScan</artifactId>
+    <version>2.0.0</version>
+
+    <dependencies>
+        <!-- https://mvnrepository.com/artifact/net.portswigger.burp.extender/burp-extender-api -->
+        <dependency>
+            <groupId>net.portswigger.burp.extender</groupId>
+            <artifactId>burp-extender-api</artifactId>
+            <version>2.3</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>1.29</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+            <version>4.5.13</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-core -->
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-core</artifactId>
+            <version>1.2.4</version>
+        </dependency>
+    </dependencies>
+
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.8.1</version>
+                <configuration>
+                    <source>1.8</source>
+                    <target>1.8</target>
+                    <encoding>UTF-8</encoding>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <version>3.3.0</version>
+                <configuration>
+                    <!-- 自定义jar包名称 -->
+                    <finalName>BurpShiroPassiveScan</finalName>
+                    <appendAssemblyId>false</appendAssemblyId>
+                    <archive>
+                        <manifest>
+                            <mainClass>burp.BurpExtender</mainClass>
+                        </manifest>
+                    </archive>
+                    <descriptorRefs>
+                        <descriptorRef>jar-with-dependencies</descriptorRef>
+                    </descriptorRefs>
+                    <outputDirectory>
+                        ${project.build.directory}/BurpShiroPassiveScan
+                    </outputDirectory>
+                </configuration>
+                <!-- 添加此项后，可直接使用mvn package | mvn install -->
+                <!-- 不添加此项，需直接使用mvn package assembly:single -->
+                <executions>
+                    <execution>
+                        <id>make-assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>3.2.0</version>
+                <executions>
+                    <execution>
+                        <id>copy-resources</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/BurpShiroPassiveScan/resources</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>src/main/resources</directory>
+                                    <includes>
+                                        <exclude>**/*</exclude>
+                                    </includes>
+                                    <filtering>true</filtering>
+                                </resource>
+                            </resources>
+                            <encoding>UTF-8</encoding>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>

src/main/java/burp/Application/ShiroCipherKeyExtension/ExtensionInterface/AShiroCipherKeyExtension.java

@@ -0,0 +1,131 @@
+package burp.Application.ShiroCipherKeyExtension.ExtensionInterface;
+
+import burp.IHttpRequestResponse;
+
+public abstract class AShiroCipherKeyExtension implements IShiroCipherKeyExtension {
+    private String extensionName = "";
+
+    private String cipherKey = "";
+
+    private String encryptMethod = "";
+
+    private Boolean isShiroCipherKeyExists = false;
+
+    private IHttpRequestResponse newHttpRequestResponse;
+
+    /**
+     * 设置扩展名称 (必须的)
+     *
+     * @param value
+     */
+    protected void setExtensionName(String value) {
+        if (value == null || value.isEmpty()) {
+            throw new IllegalArgumentException("shiro加密key检测扩展-扩展名称不能为空");
+        }
+        this.extensionName = value;
+    }
+
+    /**
+     * 扩展名称检查
+     * 作用: 让所有不设置扩展名称的扩展无法正常使用, 防止直接调用本类的其他方法, 保证扩展的正常
+     */
+    private void extensionNameCheck() {
+        if (this.extensionName == null || this.extensionName.isEmpty()) {
+            throw new IllegalArgumentException("请为该shiro加密key检测扩展-设置扩展名称");
+        }
+    }
+
+    /**
+     * 获取扩展名称
+     *
+     * @return String
+     */
+    @Override
+    public String getExtensionName() {
+        this.extensionNameCheck();
+        return this.extensionName;
+    }
+
+    /**
+     * 设置为扫描出了shiro加密的密钥key
+     */
+    protected void setShiroCipherKeyExists() {
+        this.extensionNameCheck();
+        this.isShiroCipherKeyExists = true;
+    }
+
+    /**
+     * 是否存在 shiro加密的密钥key
+     * true  表示 成功扫描出key
+     * false 表示 未能成功扫描出key
+     *
+     * @return Boolean
+     */
+    @Override
+    public Boolean isShiroCipherKeyExists() {
+        this.extensionNameCheck();
+        return this.isShiroCipherKeyExists;
+    }
+
+    /**
+     * 设置程序使用的加密方法
+     */
+    protected void setEncryptMethod(String value) {
+        this.extensionNameCheck();
+        this.encryptMethod = value;
+    }
+
+    /**
+     * 获取加密的方法
+     * 例如返回: cbc, gcm 加密算法
+     *
+     * @return String
+     */
+    @Override
+    public String getEncryptMethod() {
+        this.extensionNameCheck();
+        return this.encryptMethod;
+    }
+
+    /**
+     * 设置加密的密钥key
+     *
+     * @param value
+     */
+    public void setCipherKey(String value) {
+        this.extensionNameCheck();
+        this.cipherKey = value;
+    }
+
+    /**
+     * 获取加密的密钥key
+     *
+     * @return String
+     */
+    @Override
+    public String getCipherKey() {
+        this.extensionNameCheck();
+        return this.cipherKey;
+    }
+
+    /**
+     * 设置http请求与响应对象
+     *
+     * @param httpRequestResponse
+     */
+    protected void setHttpRequestResponse(IHttpRequestResponse httpRequestResponse) {
+        this.extensionNameCheck();
+        this.newHttpRequestResponse = httpRequestResponse;
+    }
+
+    /**
+     * 获取http请求与响应对象
+     *
+     * @return IHttpRequestResponse
+     */
+    @Override
+    public IHttpRequestResponse getHttpRequestResponse() {
+        this.extensionNameCheck();
+        return this.newHttpRequestResponse;
+    }
+}

src/main/java/burp/Application/ShiroCipherKeyExtension/ExtensionInterface/IShiroCipherKeyExtension.java

@@ -0,0 +1,24 @@
+package burp.Application.ShiroCipherKeyExtension.ExtensionInterface;
+
+import burp.IScanIssue;
+import burp.IHttpRequestResponse;
+
+/**
+ * shiro加密key扩展的公共接口
+ * 所有的抽象类都要继承它并实现所有的接口
+ */
+public interface IShiroCipherKeyExtension {
+    String getExtensionName();
+
+    Boolean isShiroCipherKeyExists();
+
+    String getEncryptMethod();
+
+    String getCipherKey();
+
+    IHttpRequestResponse getHttpRequestResponse();
+
+    IScanIssue export();
+
+    void consoleExport();
+}