Broken Link Hijacking Burp Plugin


  • Broken Link Hijacking (BLH) is lesser known attack.there is an brief introduction & exploitation about it by EdOverFlow.
https://edoverflow.com/2017/broken-link-hijacking/ by Ed
  • There is an already fully customize package for discovering BLH endpoints, https://www.npmjs.com/package/broken-link-checker but setting it up is really painful,Authentication based link validating was also an problem with it.
  • i decided to write a plugin based on following html tags,attributes

https://github.com/stevenvachon/broken-link-checker/blob/09682b3250e1b2d01e4995bac77ec77cb612db46/test/helpers/json-generators/scrapeHtml.js


Burp Extension to discover broken links using IScannerCheck & synchronized threads.

https://github.com/arbazkiraak/BurpBLH

Features:


Supports various HTML elements/attributes with regex based on following

https://github.com/stevenvachon/broken-link-checker/blob/09682b3250e1b2d01e4995bac77ec77cb612db46/test/helpers/json-generators/scrapeHtml.js

  • Concurrently checks multiple links using defined threads.
  • Customizing [STATUS_CODES|PATH-PATTERN|MIME-TYPE]

https://github.com/arbazkiraak/BurpBLH/blob/master/blhchecker.py#L20

Usage:


By default it passively scans the responses with Target “Scope in” . Make sure to add the targets into the scope. (Reason: To Avoid Noise)

WHITELIST_CODES - You can add status_code's to this list for more accurate results.

ex: avoiding https redirects by adding 301, if the path,url redirects to https.

WHITELIST_PATTERN - Regex extracting pattern based on given patterns.

  1. ex: /admin.php
  2. //google.com/test.jpg
  3. ../../img.src

WHITELIST_MEMES - Whitelisting MimeType to be processed for scanning patterns in responses if their Mime-Type matches.

ex: Mainly used to avoid performing regexes in gif,img,jpg,swf etc

no_of_threads - Increase no of threads , default : 15


Output

  • 2 Ways it outputs the broken links.
  1. Broken Links which belongs to external origins.
  2. Broken Links which belongs to same origins.
  • If there are no external origin broken links then look for same origin broken links & return same origin broken links.
  • if there are external origin broken links & same origin broken links then return only external origin broken links.

OUTPUT1: External Origins

OUTPUT2: Same Origins

This plugin is based on https://github.com/stevenvachon/broken-link-checker