GAP-Burp-Extension

• v5.4

  • Changed

    • BUG FIX: Change the self.REGEX_LINKS regex to also look for . within file names. If a file name is found that has a required extension, e.g. .js then the file name itself can also have a . in it, e.g. chunk.1337.js. Previously the regex would not have picked these up in certain situations.

• Changed

  • Change REGEX_JSNESTED (used by the Javascript variables and constants option) to also get params from nested objects that start with JSON.stringify(.

• Changed

  • Fix bug where "sus" parameters wouldn't be shown at all in the Potential param pane if the option to Report "sus" params issues was not selected.
  • Change REGEX_JSNESTED (used by the Javascript variables and constants option) to also get params from nested objects that start with dataLayer.push(.
  • Improve the description for Javascript variables and constants in the GAP Help.md.

• New

  • When the RESPONSE PARAMETERS option of Javascript variables and constants is selected, GAP will now extract parameter names from nested objects too.
  • Add Inc. Tentaive? option next to Report "sus"params? option. Findings marked Tentative will only be raised if this option is checked. If disabled it will speed up processing.

• Changed

  • Move the check for Sus param checkbox being checked to the start of checkSusParams instead of half way through, to help speed things up.
  • Change regex REGEX_PARAMSPOSSIBLE and REGEX_PARAMSSUB to check for HTML entities with the & as optional, as sometimes they appear without. This ensures they are replaced more effectively.

See CHANGELOG for details

See CHANGELOG

Bug fixes - see CHANGELOG

Fix bug with new Burp version causing files not to be written - see CHANGELOG

FIx display issue in latest Burp, plus more. See CHANGELOG

See CHANGELOG.md for details

Added 2 MIME types to exclusion list

Added an additional MIME type to ignore

Add Mass Assignment category to Sus parameters

Show instructions for installing external modules in Words mode text box if beautiful soup can't be imported

See CHANGELOG.md

See CHANGELOG.md for details

Fix a bug that fails to process a root in the site map if it contains a port number.

Small bug fixes - see CHANGELOG for details

See CHNAGELOG.md for details

See CHANGELOG.md