gh0stkey / caa Goto Github PK

View Code? Open in Web Editor NEW

768.0 13.0 50.0 3.45 MB

CaA - Collector and Analyzer, Insight into information, exploring with intelligence in a thousand ways.

License: Apache License 2.0

Java 100.00%

burpsuite bounty-hunters bounty-hunting-tools

caa's Introduction

关于CaA

CaA是一款网络安全（漏洞挖掘）领域下的辅助型项目，主要用于分析、拆解HTTP协议报文，提取HTTP协议报文中的参数、路径、文件、参数值等信息，并统计出现的频次，帮助用户构建出具有实战应用价值的Fuzzing字典。除此之外CaA可以生成各类HTTP请求提供给BurpSuite Intruder用于Fuzzing工作。

CaA的设计**来源于Web Fuzzing技术，皆在帮助用户发现隐藏的漏洞面，通过对信息的收集分析整理，让用户真正意义上的实现数据挖掘。

思路来源:

所获荣誉:

入选2024年KCon兵器谱

注意事项:

CaA采用Montoya API进行开发，需要满足BurpSuite版本（>=2023.12.1）才能使用。

使用方法

插件装载: Extender - Extensions - Add - Select File - Next

初次装载CaA会自动创建配置文件Config.json和数据库文件CaA.db：

Linux/Mac用户的配置文件目录：~/.config/CaA/
Windows用户的配置文件目录：%USERPROFILE%/.config/CaA/

除此之外，您也可以选择将配置文件存放在CaA Jar包的同级目录下的/.config/CaA/中，以便于离线携带。

你可以很方便的在CollectInfo中右键选择RAW、JSON、XML类型的参数值进行复制，用于对请求的测试。

功能说明

收集的信息类型：

GET、POST正常形式参数和值；
Cookie名和值；
POST（JSON、Multipart、XML）参数和值；
逐层路径、文件和完整路径。

生成的Payload信息：

GET请求；
POST请求；
POST With JSON请求；
POST With XML请求；
POST With Multipart请求；
目录逐层遍历请求。

界面信息

界面名称	界面展示
Databoard（数据集合）
Config（配置管理）
Generator（字典生成）
CollectInfo（数据展示）

最后

如果你觉得CaA好用，可以打赏一下作者，给作者持续更新下去的动力！

caa's People

Contributors

Stargazers

Watchers

caa's Issues

Why don't you have a jar file?

Why don't you have a jar file?
How to download and use it?

java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:435)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:468)
at burp.e7u.a(Unknown Source)
at burp.e7u.(Unknown Source)
at burp.a_p.a(Unknown Source)
at burp.fpe.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
at java.base/java.lang.Thread.run(Thread.java:832)

建议使用doPassiveScan

因为用了云数据库，所以出了点儿问题Orz。processHttpMessage每次处理请求的时候要🔗数据库，就导致处理时间变长，然后响应时间就变慢了，略微影响了使用😭，这种情况下是不是doPassiveScan兼容性要高点儿👀

加载插件时出错且burp卡住，错误如下，不止是否是因为utilities().urlUtils()处理含\u00xx Unicode编码的字符出错

加载报错[BUG]

使用环境

CaA版本：0.9
BurpSuite版本：22.3.7
JDK版本：BurpSuite自带
操作系统版本：windows11

问题详情

问题描述：
安装插件时报错
java.lang.ClassNotFoundException: burp.BurpExtender
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:433)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:586)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:519)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:466)
at burp.cvr.a(Unknown Source)
at burp.cvr.(Unknown Source)
at burp.cru.a(Unknown Source)
at burp.av0.lambda$panelLoaded$0(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
at java.base/java.lang.Thread.run(Thread.java:831)

出现的场景：

解决建议

无。

该插件不支持22年的burp吗

似乎并不支持旧版本burp，这个问题能否解决，因为burp有其他插件，在较新版本的bp并不兼容

查询结果能否支持csv导出功能

你好，非常感谢你编写这款实用的工具，我有个建议，能不能支持查询结果导出，能导出txt、csv之类的简单格式就行，还有查询时能否支持主域名，比如“sp2.baidu.com”只需要输入“baidu.com”即可查到。

burp导入后数据库也连接成功，挖洞时一直未存入数据库。整个数据库表是空的

[ADVISE]师傅能做一个可以控制不让CaA进行停止抓取，内存占用会比较高

使用环境

CaA版本：
BurpSuite版本：
JDK版本：BurpSuite自带
操作系统版本：

问题详情

问题描述：

出现的场景：

解决建议

无。

【功能优化】师傅，路径功能能否优化为完整路径

使用环境

CaA版本：0.9
BurpSuite版本：
JDK版本：BurpSuite自带
操作系统版本：

问题详情

问题描述：
师傅，路径功能能否优化为完整路径，提取到的路径都是单级路径/cc这样，能否优化为完整路径/aa/bb/cc这样

出现的场景：

解决建议

无。

[BUG]

老哥，请问这个0.9版本适用的最低burpsuite版本是多少呀？

建议添加占位符

使用环境

CaA版本：/
BurpSuite版本：/
JDK版本：BurpSuite自带
操作系统版本：/

建议

添加占位符功能可以指定参数名和参数值在json格式里进行fuzz

遇到收集不到的目录

这种#号的似乎压根不会加载到burp

运行后没有任何数据

使用环境

CaA版本：Beta 0.9
BurpSuite版本：v2024.4.5
JDK版本：BurpSuite自带
操作系统版本：win10

问题详情

问题描述：
send to fuzzer后，在taskboard页面只能搜索到task name，下方无数据。

出现的场景：
开始fuzz

解决建议

无。

功能建议与bug

burp：2024.3.1.3
JDK：21

参数匹配处出现异常（已筛选域名，图中域名为防泄露已删除），前半部分收集到正常参数，后半部分收集的就是垃圾字符：

另外插件还有报错：

	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:775)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:720)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:714)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:98)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:747)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:744)
	at burp.Zwr6.dispatchEvent(Unknown Source)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)
java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: "ï¿"
	at java.base/java.net.URLDecoder.decode(URLDecoder.java:243)
	at burp.Zevb.decode(Unknown Source)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at burp.Zrp.invoke(Unknown Source)
	at jdk.proxy2/jdk.proxy2.$Proxy124.decode(Unknown Source)
	at burp.Zd9q.decode(Unknown Source)
	at caa.instances.Collector.decodeParameter(Collector.java:268)
	at caa.instances.Collector.passiveAudit(Collector.java:114)
	at caa.instances.editor.ResponseEditor$Editor.isEnabledFor(ResponseEditor.java:80)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at burp.Zrp.invoke(Unknown Source)
	at jdk.proxy5/jdk.proxy5.$Proxy103.isEnabledFor(Unknown Source)
	at burp.Zhz5.Zy(Unknown Source)
	at burp.Zh2r.Zi(Unknown Source)
	at burp.Zeq_.lambda$updateVisiblePanes$1(Unknown Source)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1708)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at burp.Zde7.ZC(Unknown Source)
	at burp.Zde7.ZR(Unknown Source)
	at burp.Zeq_.Zt(Unknown Source)
	at burp.Zeq_.Zs(Unknown Source)
	at burp.Zd8j.Zw(Unknown Source)
	at burp.Zd8j.lambda$new$2(Unknown Source)
	at java.desktop/java.awt.Component.processHierarchyEvent(Component.java:6788)
	at java.desktop/java.awt.Component.processEvent(Component.java:6407)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.Component.createHierarchyEvents(Component.java:5634)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1474)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Container.createHierarchyEvents(Container.java:1470)
	at java.desktop/java.awt.Component.show(Component.java:1691)
	at java.desktop/java.awt.Component.show(Component.java:1728)
	at java.desktop/java.awt.Component.setVisible(Component.java:1675)
	at java.desktop/javax.swing.JComponent.setVisible(JComponent.java:2729)
	at java.desktop/javax.swing.JTabbedPane.fireStateChanged(JTabbedPane.java:424)
	at java.desktop/javax.swing.JTabbedPane$ModelListener.stateChanged(JTabbedPane.java:297)
	at java.desktop/javax.swing.DefaultSingleSelectionModel.fireStateChanged(DefaultSingleSelectionModel.java:148)
	at java.desktop/javax.swing.DefaultSingleSelectionModel.setSelectedIndex(DefaultSingleSelectionModel.java:79)
	at java.desktop/javax.swing.JTabbedPane.setSelectedIndexImpl(JTabbedPane.java:650)
	at java.desktop/javax.swing.JTabbedPane.setSelectedIndex(JTabbedPane.java:625)
	at burp.Zcem.setSelectedIndex(Unknown Source)
	at java.desktop/javax.swing.plaf.basic.BasicTabbedPaneUI$Handler.mousePressed(BasicTabbedPaneUI.java:4140)
	at com.formdev.flatlaf.ui.FlatTabbedPaneUI$Handler.mousePressed(FlatTabbedPaneUI.java:2697)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.Component.processMouseEvent(Component.java:6618)
	at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3398)
	at java.desktop/java.awt.Component.processEvent(Component.java:6386)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at burp.Zwpj.ZU(Unknown Source)
	at burp.Zmc_.mousePressed(Unknown Source)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:288)
	at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
	at java.desktop/java.awt.Component.processMouseEvent(Component.java:6618)
	at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3398)
	at java.desktop/java.awt.Component.processEvent(Component.java:6386)
	at java.desktop/java.awt.Container.processEvent(Container.java:2266)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:4996)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4948)
	at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4572)
	at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4516)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2310)
	at java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2780)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4828)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:775)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:720)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:714)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:98)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:747)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:87)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:744)
	at burp.Zwr6.dispatchEvent(Unknown Source)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

最后有一个功能建议，可否添加一个右键删除功能：

多谢老哥

安装插件出现报错

是需要单独配置数据库么

加载报错

使用环境

CaA版本：0.8/0.9
BurpSuite版本：BurpSuite V2024.3.1
JDK版本：java8
操作系统版本：windows10

问题详情

问题描述：
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.

出现的场景：

解决建议

无。

已解决

[BUG] caA的Tab中看不到settings按钮，无法进行配置

使用环境

CaA版本：
CaA-Beta-0.9

BurpSuite版本：
burpsuite_pro_v2024.3.1.4

JDK版本：jdk-22.0.1

操作系统版本：win10

问题详情

问题描述：
caA成功加载到burp，无报错，但是Tab中看不到settings按钮

出现的场景：
上述环境中，CaA-Beta-0.9与0.8均有此现象，且尝试调整过burp字体大小设置，发现并没有效果

解决建议

无。

v0.5版本连接数据库后成功创建表结构，但无数据

环境：
intel macOS 13.3.1 (22E261)
Burp Suite Professional v2022.12.5
CaA-0.5-J8.jar
MYSQL Server version: 8.0.32 Homebrew

(BP使用的是高版本JDK，但是我在Bp的Extensions-Options-Java Environment配置了JAVA1.8.0_151环境，我其他插件如HaE(2.4.6)、xia SQL V3.3均使用的是J8版本。)

情况：
Connect后无异常报错，数据库成功创建表结构。

请问和创建数据库选择的这些有关系吗？

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

gh0stkey / caa Goto Github PK

caa's Introduction

第一作者： EvilChen（中孚信息元亨实验室）, 第二作者： 0chencc（米斯特安全团队）

关于CaA

使用方法

功能说明

界面信息

最后

caa's People

Contributors

Stargazers

Watchers

Forkers

caa's Issues

使用环境

问题详情

解决建议

使用环境

问题详情

解决建议

使用环境

问题详情

解决建议

使用环境

建议

使用环境

问题详情

解决建议

使用环境

问题详情

解决建议

使用环境

问题详情

解决建议

Recommend Projects

Recommend Topics

Recommend Org