Skip to content
This repository has been archived by the owner on May 2, 2020. It is now read-only.

Commit

Permalink
Change name; create manifest and description
Browse files Browse the repository at this point in the history
  • Loading branch information
pajswigger committed Jun 6, 2018
1 parent bf20fc9 commit e7f7986
Show file tree
Hide file tree
Showing 3 changed files with 58 additions and 1 deletion.
46 changes: 46 additions & 0 deletions BappDescription.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
<p><b>Warning!</b> At this moment the extension can degrade Burp Suite's performance
when scanning large sites. This will be fixed in the near future.</p>

<p>Similar Request Excluder (also referred to as GraphWave) is an extension
that enables you to automatically reduce the target scope of your active
scan by excluding similar (and therefore redundant) requests.</p>

<p>Reducing the target scope can be done by ignoring similar HTTP responses
from the spider. If two HTTP responses have the same HTML structure it is
likely that they have the same code flow and therefore the same security
vulnerabilities. By measuring the similarity of HTTP responses it is
possible to automatically reduce the target scope by removing the similar
(and therefore redundant) HTTP responses.</p>

<p>For more information, please refer to the thesis <a href="https://github.com/tijme/graphwave/raw/master/.github/thesis-graphwave-tijme-gommers.pdf">Github</a>.</p>

<p><b>Usage</b></p>

<ol>
<li>Make sure the extension is enabled by ticking the <i>Status</i> checkbox in
the GraphWave tab.</li>
<li>Adjust the settings to your needs (default should be sufficient).</li>
<li>Spider a complete host or a specific branch of a host.</li>
<li>When done, mark similar requests as <i>out-of-scope</i> in the scope menu
of the GraphWave tab.</li>
<li>Now start an active scan and make sure to check <i>remove out-of-scope
items</i>.</li>
</ol>

<p><b>Documentation</b></p>

<p>The full documentation is available on <a href="https://github.com/tijme/graphwave/wiki">Github</a>. It contains, among other things,
extra installation <a href="https://github.com/tijme/graphwave/wiki/Installation">instructions</a> and the
<a href="https://github.com/tijme/graphwave/wiki/F.A.Q">FAQ</a>.

<p><b>Requirements</b></p>

<p>This extension requires the Oracle JDK (version 9 or later). Open JDK will
not work.</p>

<p><b>Issues</b></p>

<p>If you are experiencing problems with Similar Request Excluder, please file
an issue on the GitHub <a href="https://github.com/tijme/graphwave/issues">issue tracker</a> or contact me personally via
<a href="https://twitter.com/finnwea">Twitter</a>.</p>

11 changes: 11 additions & 0 deletions BappManifest.bmf
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
Uuid: 9ecd51851baf4ae6b69c6a951257387a
ExtensionType: 2
Name: Similar Request Excluder
RepoName: similar-request-excluder
ScreenVersion: 1.0.2
SerialVersion: 1
MinPlatformVersion: 0
ProOnly: False
Author: Tijme Gommers
ShortDescription: Detects similar CFG-paths from HTTP responses, to improve efficiency of scans.
EntryPoint: extension/Extension.py
2 changes: 1 addition & 1 deletion extension/ExtensionDetails.py
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ class ExtensionDetails:
"""

TITLE = "GraphWave"
TITLE = "Similar Request Excluder"

VERSION = "Unknown"

Expand Down

0 comments on commit e7f7986

Please sign in to comment.