• 图片不用处理

      1.           String mimeInferred = helpers.analyzeResponse(messageInfo.getResponse()).getInferredMimeType();
      2.           if ((mimeInferred.equalsIgnoreCase("JPEG"))
      3.                   ||  (mimeInferred.equalsIgnoreCase("PNG"))
      4.                   ||  (mimeInferred.equalsIgnoreCase("TIFF"))
      5.                   ||  (mimeInferred.equalsIgnoreCase("GIF"))) {

    • 扫描到结果上报到系统里（不常用：没必要到他系统里，有地方log下来即可）

      1.                   callbacks.addScanIssue(new CustomScanIssue(
      2.                           messageInfo.getHttpService(),
      3.                           helpers.analyzeRequest(messageInfo).getUrl(),
      4.                           new IHttpRequestResponse[]{callbacks.applyMarkers(messageInfo, null, match)},
      5.                           "Information disclosure at ImageMagick at converter tool",
      6.                           "The response contains sensitive internal server information",
      7.                           "Medium"));
      8.               }

    • respInfo.getStatusCode()中定义过滤没必要的处理的statusCode.

    • helpers.indexOf(request,helpers.stringToBytes(“<@/“), true, 0, request.length) > -1 比较byte中是否存在某某。

    • toolFlag指示了发起请求或收到响应的Burp工具的ID（判断是在哪里，Repeater、Proxy、Scanner等）

    • 调试发起Request请求

      1.                   IHttpRequestResponse resp = callbacks.makeHttpRequest(messageInfo.getHttpService(), helpers.buildHttpMessage(reqInfo.getHeaders(), bodyss));

    • 避免重复死循环发起请求

      1. if (toolFlag == 4) { // 避免循环
      2. }

    • Java并发使用executor.submit (具体再细看看)

      1. executor.submit(
      2.           () -> autoRepeater.modifyAndSendRequestAndLog(
      3.               toolFlag,
      4.               messageInfo)
      5.       );