From 7bed75e912c19082b85580b63488304fc219dc03 Mon Sep 17 00:00:00 2001 From: Dolph Flynn <96876199+DolphFlynn@users.noreply.github.com> Date: Wed, 14 Feb 2024 18:34:43 +0000 Subject: [PATCH] Add checkbox to control JWS resigning within payload processor rule. --- .../java/burp/intruder/IntruderConfig.java | 3 +- .../burp/intruder/JWSPayloadProcessor.java | 5 +- .../blackberry/jwteditor/utils/Constants.java | 5 -- .../jwteditor/view/config/ConfigView.form | 27 +++++++-- .../jwteditor/view/config/ConfigView.java | 60 +++++++++++-------- 5 files changed, 59 insertions(+), 41 deletions(-) delete mode 100644 src/main/java/com/blackberry/jwteditor/utils/Constants.java diff --git a/src/main/java/burp/intruder/IntruderConfig.java b/src/main/java/burp/intruder/IntruderConfig.java index ad4d222..70cf77a 100644 --- a/src/main/java/burp/intruder/IntruderConfig.java +++ b/src/main/java/burp/intruder/IntruderConfig.java @@ -19,7 +19,6 @@ package burp.intruder; import static burp.intruder.FuzzLocation.PAYLOAD; -import static com.blackberry.jwteditor.utils.Constants.INTRUDER_NO_SIGNING_KEY_ID_LABEL; import static org.apache.commons.lang3.StringUtils.isNotEmpty; public class IntruderConfig { @@ -67,6 +66,6 @@ public void setResign(boolean resign) { } private boolean isSigningKeyIdValid() { - return !INTRUDER_NO_SIGNING_KEY_ID_LABEL.equals(signingKeyId) && isNotEmpty(signingKeyId); + return isNotEmpty(signingKeyId); } } diff --git a/src/main/java/burp/intruder/JWSPayloadProcessor.java b/src/main/java/burp/intruder/JWSPayloadProcessor.java index 2d46aac..b15b958 100644 --- a/src/main/java/burp/intruder/JWSPayloadProcessor.java +++ b/src/main/java/burp/intruder/JWSPayloadProcessor.java @@ -18,7 +18,7 @@ import static burp.intruder.FuzzLocation.PAYLOAD; import static com.blackberry.jwteditor.model.jose.JOSEObjectFinder.parseJOSEObject; -import static com.blackberry.jwteditor.utils.Constants.INTRUDER_NO_SIGNING_KEY_ID_LABEL; +import static org.apache.commons.lang3.StringUtils.isNotEmpty; public class JWSPayloadProcessor implements PayloadProcessor { private final Logging logging; @@ -63,8 +63,7 @@ public PayloadProcessingResult processPayload(PayloadData payloadData) { private Optional loadKey() { String keyId = intruderConfig.signingKeyId(); - // only try to load key if the input value is non-empty - if (keyId == INTRUDER_NO_SIGNING_KEY_ID_LABEL || keyId == null || keyId.trim().isEmpty()) { + if (isNotEmpty(keyId)) { return Optional.empty(); } diff --git a/src/main/java/com/blackberry/jwteditor/utils/Constants.java b/src/main/java/com/blackberry/jwteditor/utils/Constants.java deleted file mode 100644 index 16571a3..0000000 --- a/src/main/java/com/blackberry/jwteditor/utils/Constants.java +++ /dev/null @@ -1,5 +0,0 @@ -package com.blackberry.jwteditor.utils; - -public class Constants { - public static String INTRUDER_NO_SIGNING_KEY_ID_LABEL = ""; -} diff --git a/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.form b/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.form index 6244926..28f720e 100644 --- a/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.form +++ b/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.form @@ -3,7 +3,7 @@ - + @@ -173,7 +173,7 @@ - + @@ -214,10 +214,9 @@ - - + @@ -226,11 +225,10 @@ - + - @@ -239,6 +237,23 @@ + + + + + + + + + + + + + + + + + diff --git a/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.java b/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.java index 41c05d4..5909acd 100644 --- a/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.java +++ b/src/main/java/com/blackberry/jwteditor/view/config/ConfigView.java @@ -18,7 +18,6 @@ package com.blackberry.jwteditor.view.config; -import burp.api.montoya.logging.Logging; import burp.api.montoya.ui.UserInterface; import burp.config.BurpConfig; import burp.intruder.FuzzLocation; @@ -26,27 +25,22 @@ import burp.proxy.HighlightColor; import burp.proxy.ProxyConfig; import burp.scanner.ScannerConfig; - import com.blackberry.jwteditor.model.keys.Key; import com.blackberry.jwteditor.model.keys.KeysModel; import com.blackberry.jwteditor.model.keys.KeysModelListener; import com.blackberry.jwteditor.view.utils.DocumentAdapter; -import static com.blackberry.jwteditor.utils.Constants.INTRUDER_NO_SIGNING_KEY_ID_LABEL; import javax.swing.*; - -import org.apache.commons.lang3.ArrayUtils; - import java.awt.*; -import java.util.Arrays; +import java.util.List; +import java.util.Optional; import static java.awt.Font.BOLD; -/** - * Config panel - */ public class ConfigView implements KeysModelListener { + private final IntruderConfig intruderConfig; + private JPanel mainPanel; private JCheckBox checkBoxHighlightJWT; private JLabel labelHighlightColor; @@ -63,11 +57,14 @@ public class ConfigView implements KeysModelListener { private JLabel scannerLabel; private JPanel intruderPanel; private JLabel spacerLabel; + private JCheckBox resignIntruderJWS; private KeysModel keysModel; public ConfigView(BurpConfig burpConfig, UserInterface userInterface, boolean isProVersion, KeysModel keysModel) { - ProxyConfig proxyConfig = burpConfig.proxyConfig(); this.keysModel = keysModel; + this.intruderConfig = burpConfig.intruderConfig(); + + ProxyConfig proxyConfig = burpConfig.proxyConfig(); keysModel.addKeyModelListener(this); checkBoxHighlightJWT.setSelected(proxyConfig.highlightJWT()); @@ -81,8 +78,6 @@ public ConfigView(BurpConfig burpConfig, UserInterface userInterface, boolean is comboBoxHighlightColor.setEnabled(proxyConfig.highlightJWT()); comboBoxHighlightColor.addActionListener(e -> proxyConfig.setHighlightColor((HighlightColor) comboBoxHighlightColor.getSelectedItem())); - IntruderConfig intruderConfig = burpConfig.intruderConfig(); - intruderParameterName.setText(intruderConfig.fuzzParameter()); intruderParameterName.getDocument().addDocumentListener( new DocumentAdapter(e -> intruderConfig.setFuzzParameter(intruderParameterName.getText())) @@ -93,8 +88,8 @@ public ConfigView(BurpConfig burpConfig, UserInterface userInterface, boolean is comboBoxPayloadPosition.addActionListener(e -> intruderConfig.setFuzzLocation((FuzzLocation) comboBoxPayloadPosition.getSelectedItem())); this.updateSigningKeyList(); - comboBoxIntruderSigningKeyId.setSelectedItem(intruderConfig.signingKeyId()); comboBoxIntruderSigningKeyId.addActionListener(e -> intruderConfig.setSigningKeyId((String) comboBoxIntruderSigningKeyId.getSelectedItem())); + resignIntruderJWS.addActionListener(e -> intruderConfig.setResign(resignIntruderJWS.isSelected())); ScannerConfig scannerConfig = burpConfig.scannerConfig(); @@ -120,18 +115,33 @@ public ConfigView(BurpConfig burpConfig, UserInterface userInterface, boolean is } public void updateSigningKeyList() { - String[] noSigningKey = {INTRUDER_NO_SIGNING_KEY_ID_LABEL}; - String[] signingKeyIds = this.keysModel.getSigningKeys().stream().map(key -> key.getID()).toArray(String[]::new); - String[] items = ArrayUtils.addAll(noSigningKey, signingKeyIds); - - String currentSelection = (String) comboBoxIntruderSigningKeyId.getSelectedItem(); - boolean resetSelection = currentSelection != null && !Arrays.stream(items).anyMatch(currentSelection::equals); - - comboBoxIntruderSigningKeyId.setModel(new DefaultComboBoxModel<>(items)); - if (resetSelection) { - comboBoxIntruderSigningKeyId.setSelectedItem(INTRUDER_NO_SIGNING_KEY_ID_LABEL); + List signingKeys = keysModel.getSigningKeys(); + String[] signingKeyIds = signingKeys.stream().map(Key::getID).toArray(String[]::new); + String selectedSigningId = intruderConfig.signingKeyId(); + + comboBoxIntruderSigningKeyId.setModel(new DefaultComboBoxModel<>(signingKeyIds)); + + if (signingKeys.isEmpty()) { + resignIntruderJWS.setSelected(false); + resignIntruderJWS.setEnabled(false); + comboBoxIntruderSigningKeyId.setEnabled(false); + intruderConfig.setResign(false); + intruderConfig.setSigningKeyId(null); } else { - comboBoxIntruderSigningKeyId.setSelectedItem(currentSelection); + resignIntruderJWS.setEnabled(true); + comboBoxIntruderSigningKeyId.setEnabled(true); + + Optional selectedKey = signingKeys.stream() + .filter(k -> k.getID().equals(selectedSigningId)) + .findFirst(); + + if (selectedKey.isPresent()) { + resignIntruderJWS.setSelected(intruderConfig.resign()); + comboBoxIntruderSigningKeyId.setSelectedItem(selectedKey.get()); + } else { + resignIntruderJWS.setSelected(false); + comboBoxIntruderSigningKeyId.setSelectedIndex(0); + } } }