Method doActiveScan

src/burp/SuspectTransform.java:58–106

(IHttpRequestResponse basePair, IScannerInsertionPoint insertionPoint)

    }

    @Override
    public List<IScanIssue> doActiveScan(IHttpRequestResponse basePair, IScannerInsertionPoint insertionPoint) {
        String base = insertionPoint.getBaseValue();
        String initialResponse = safeBytesToString(basePair.getResponse());
        List<IScanIssue> issues = new ArrayList<>();
        Map<String, Check> checksCopy = new HashMap<>(this.checks);

        while (!checksCopy.isEmpty()) {
            Map.Entry<String, Check> entry = checksCopy.entrySet().iterator().next();
            checksCopy.remove(entry.getKey());
            String name = entry.getKey();
            Check check = entry.getValue();

            for (int attempt = 0; attempt < confirmCount; attempt++) {
                Pair<String, List<String>> result = check.apply(base);
                String probe = result.getKey();
                List<String> expect = result.getValue();

                Utilities.log("Trying " + probe);
                IHttpRequestResponse attack = OldUtilities.request2(basePair, insertionPoint, probe);
                String attackResponse = safeBytesToString(attack.getResponse());

                boolean matched = false;
                for (String e : expect) {
                    if (attackResponse.contains(e) && !initialResponse.contains(e)) {
                        matched = true;
                        if (attempt == confirmCount - 1) {
                            issues.add(new CustomScanIssue(
                                    attack.getHttpService(),
                                    helpers.analyzeRequest(attack).getUrl(),
                                    new IHttpRequestResponse[]{attack},
                                    "Suspicious input transformation: " + name,
                                    "The application transforms input in a way that suggests it might be vulnerable to some kind of server-side code injection:<br/><br/> "
                                            + "The following probe was sent: <b>" + probe + "</b><br/>"
                                            + "The server response contained the evaluated result: <b>" + e + "</b><br/><br/>Manual investigation is advised.",
                                    "Tentative", CustomScanIssue.severity.High));
                        }
                        break;
                    }
                }

                if (!matched) {
                    break;
                }
            }
        }

        return issues;
    }

    @FunctionalInterface
    private interface Check {