Xkeys (BurpSuite Extension)

Description

A Burp Suite Extension to extract interesting strings (key, secret, token, or etc.) from a webpage. and lists them as information issues.

Type : Passive Scanner

Setup

• Setup the python environment by providing the Jython.jar file in the 'Options' tab under 'Extender' in Burp Suite.
• Download the BurpSuite-Xkeys.zip.
• In the 'Extensions' tab under 'Extender', select 'Add'.
• Change the extension type to 'Python'.
• Provide the path of the file "Xkeys.py" and click on 'Next'.

Usage

• The extension will start identifying assets through passive scan.

Result

• The extension will show on issues box and on output extender

Possible Value Extraction

{keyword}=
{keyword}= 
{keyword} =
{keyword} = 
{keyword}'=''
{keyword}'= ''
{keyword}' =''
{keyword}' = ''
{keyword}"=""
{keyword}"= ""
{keyword}" =""
{keyword}" = ""
{keyword}":""
{keyword}": ""
{keyword}" :""
{keyword}" : ""
{keyword}=&

Requirements

• Jython 2.7.0
• Burp Suite Pro

Code Credits:

# PortSwigger example-scanner-checks: https://github.com/PortSwigger/example-scanner-checks
# RedHuntLabs BurpSuite-Asset_Discover: https://github.com/redhuntlabs/BurpSuite-Asset_Discover

• Sec7or Team
• Surabaya Hacker Link