Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ClientIP and ListenerInterface no longer usable #109

Open
CoreyD97 opened this issue Jul 27, 2020 · 2 comments
Open

ClientIP and ListenerInterface no longer usable #109

CoreyD97 opened this issue Jul 27, 2020 · 2 comments
Assignees
Labels

Comments

@CoreyD97
Copy link
Contributor

Description:
With the new updates, clientip and listenerinterface are no longer set for requests and cannot be used. These were useful in situations where using two browsers configured with different ports as requests could be highlighted based on incoming port / browser.

Cause:
Moving from processProxyMessage to processHttpMessage removed the ability to access these fields.

Solution:
Allow control over which method is used to detect requests coming into the proxy.

processProxyMessage:

  • Allows listenerinterface, clientip fields to be used
  • Does not show modified request where tools use the processHttpMessage to edit the content

processHttpMessage:

  • Breaks listenerinterface, clientip fields
  • Captures modified request properly

Reported by twitter.com/thebl4ckturtle

@justinsteven
Copy link

It's very gross, but this seems to get the Listener Interface back in a hacky way. The first hunk might not be necessary, the second hunk seems to be doing all the work in my testing.

I don't know that this is a sustainable solution. And I'm guessing the java.lang.UnsupportedOperationException is a Burp/Montoya problem.

diff --git a/src/main/java/com/nccgroup/loggerplusplus/logview/processor/LogProcessor.java b/src/main/java/com/nccgroup/loggerplusplus/logview/processor/LogProcessor.java
index 037110b..3fbdc12 100644
--- a/src/main/java/com/nccgroup/loggerplusplus/logview/processor/LogProcessor.java
+++ b/src/main/java/com/nccgroup/loggerplusplus/logview/processor/LogProcessor.java
@@ -234,6 +234,11 @@ public class LogProcessor {
         if (entriesPendingProcessing.containsKey(entryIdentifier)) {
             //Not yet started processing the entry, we can add the response so it is processed in the first pass
             final LogEntry logEntry = entriesPendingProcessing.get(entryIdentifier);
+            if (response instanceof InterceptedResponse) {
+                // Raises java.lang.UnsupportedOperationException: Not yet implemented
+                //logEntry.setClientIP(String.valueOf(((InterceptedResponse) response).sourceIpAddress()));
+                logEntry.setListenerInterface(((InterceptedResponse) response).listenerInterface());
+            }
             //Update the response with the new one, and tell it when it arrived.
             logEntry.addResponse(response, arrivalTime);

@@ -330,6 +335,11 @@ public class LogProcessor {
             }

             //Request was processed successfully... now process the response.
+            if (requestResponse instanceof InterceptedResponse) {
+                // Raises java.lang.UnsupportedOperationException: Not yet implemented
+                //logEntry.setClientIP(String.valueOf(((InterceptedResponse) requestResponse).sourceIpAddress()));
+                logEntry.setListenerInterface(((InterceptedResponse) requestResponse).listenerInterface());
+            }
             logEntry.addResponse(requestResponse, arrivalTime);
             LogEntry updatedEntry = processEntry(logEntry);

@CoreyD97
Copy link
Contributor Author

Sorry for the delay on this one. I've spoken to PortSwigger and it seems that the clientIP can only be retrieved from the request. Though, due to the way requests and responses must be captured to make sure they represent the final request, we can't use the proxy listener interface for requests, only responses.

Whilst it would be possible to implement this, it'll need some significant changes to do so.

I'll implement the listener interface for now and look for a better solution in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants