// Path: src/main/java/burp/j2ee/PassiveScanner.java
// public class PassiveScanner {
// 
//     /**
//      * List of passive rules
//      */
//     static PassiveRule[] PASSIVE_RULES = {new ApacheTomcatRule(), 
//         new ExceptionRule(), 
//         new HttpServerHeaderRule(), 
//         new SqlQueryRule(),
//         new ApacheStrutsS2023Rule(),
//         new JettyRule(),
//         new SessionIDInURL(),
//         new JSPostMessage(),
//         new SessionFixation(),
//         new LiferayRule()
//     };
// 
//     public static void scanVulnerabilities(IHttpRequestResponse baseRequestResponse,
//                                            IBurpExtenderCallbacks callbacks) {
// 
//         IExtensionHelpers helpers = callbacks.getHelpers();
// 
//         byte[] rawRequest = baseRequestResponse.getRequest();
//         byte[] rawResponse = baseRequestResponse.getResponse();
// 
//         IRequestInfo reqInfo = helpers.analyzeRequest(baseRequestResponse);
//         IResponseInfo respInfo = helpers.analyzeResponse(rawResponse);
// 
//         //Body (without the headers)
//         String reqBody = getBodySection(rawRequest, reqInfo.getBodyOffset());
//         String respBody = getBodySection(rawResponse, respInfo.getBodyOffset());
// 
//         String httpServerHeader = HTTPParser.getResponseHeaderValue(respInfo, "Server");
//         String contentTypeResponse = HTTPParser.getResponseHeaderValue(respInfo, "Content-Type");
//         String xPoweredByHeader = HTTPParser.getResponseHeaderValue(respInfo, "X-Powered-By");
// 
//         for(PassiveRule scanner : PASSIVE_RULES) {
//             scanner.scan(callbacks,baseRequestResponse,reqBody,respBody,reqInfo,respInfo,
//                     httpServerHeader,contentTypeResponse, xPoweredByHeader);
//         }
// 
//     }
// 
// 
//     private static String getBodySection(byte[] respBytes, int bodyOffset) {
//         return new String(respBytes, bodyOffset, respBytes.length - bodyOffset);
//     }
// }


import burp.j2ee.PassiveScanner;
import java.io.PrintWriter;
import java.net.URL;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
                            makeHttpRequest);

                    IResponseInfo httpAuthAttemptResponse = helpers.analyzeResponse(responseWeakPassword);
                    IHttpService httpServiceInstance = new IHttpService() {

                        @Override
                        public String getHost() {
                            return urlToTest.getHost();
                        }

                        @Override
                        public int getPort() {
                            return urlToTest.getPort();
                        }

                        @Override
                        public String getProtocol() {
                            return urlToTest.getProtocol();
                        }
                    };

                    // Weak Password found
                    if (httpAuthAttemptResponse.getStatusCode() == 200) {
                        stdout.println("[!] Weak Credentils " + user + ":" + pwd+ " on " + urlToTest);
                        CustomHttpRequestResponse result = new CustomHttpRequestResponse(
                                makeHttpRequest,
                                responseWeakPassword,
                                httpServiceInstance);


// Path: src/main/java/burp/j2ee/PassiveScanner.java
// public class PassiveScanner {
// 
//     /**
//      * List of passive rules
//      */
//     static PassiveRule[] PASSIVE_RULES = {new ApacheTomcatRule(), 
//         new ExceptionRule(), 
//         new HttpServerHeaderRule(), 
//         new SqlQueryRule(),
//         new ApacheStrutsS2023Rule(),
//         new JettyRule(),
//         new SessionIDInURL(),
//         new JSPostMessage(),
//         new SessionFixation(),
//         new LiferayRule()
//     };
// 
//     public static void scanVulnerabilities(IHttpRequestResponse baseRequestResponse,
//                                            IBurpExtenderCallbacks callbacks) {
// 
//         IExtensionHelpers helpers = callbacks.getHelpers();
// 
//         byte[] rawRequest = baseRequestResponse.getRequest();
//         byte[] rawResponse = baseRequestResponse.getResponse();
// 
//         IRequestInfo reqInfo = helpers.analyzeRequest(baseRequestResponse);
//         IResponseInfo respInfo = helpers.analyzeResponse(rawResponse);
// 
//         //Body (without the headers)
//         String reqBody = getBodySection(rawRequest, reqInfo.getBodyOffset());
//         String respBody = getBodySection(rawResponse, respInfo.getBodyOffset());
// 
//         String httpServerHeader = HTTPParser.getResponseHeaderValue(respInfo, "Server");
//         String contentTypeResponse = HTTPParser.getResponseHeaderValue(respInfo, "Content-Type");
//         String xPoweredByHeader = HTTPParser.getResponseHeaderValue(respInfo, "X-Powered-By");
// 
//         for(PassiveRule scanner : PASSIVE_RULES) {
//             scanner.scan(callbacks,baseRequestResponse,reqBody,respBody,reqInfo,respInfo,
//                     httpServerHeader,contentTypeResponse, xPoweredByHeader);
//         }
// 
//     }
// 
// 
//     private static String getBodySection(byte[] respBytes, int bodyOffset) {
//         return new String(respBytes, bodyOffset, respBytes.length - bodyOffset);
//     }
// }


// Path: src/main/java/burp/WeakPasswordBruteforcer.java
import burp.j2ee.PassiveScanner;
import java.io.PrintWriter;
import java.net.URL;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

                            makeHttpRequest);

                    IResponseInfo httpAuthAttemptResponse = helpers.analyzeResponse(responseWeakPassword);
                    IHttpService httpServiceInstance = new IHttpService() {

                        @Override
                        public String getHost() {
                            return urlToTest.getHost();
                        }

                        @Override
                        public int getPort() {
                            return urlToTest.getPort();
                        }

                        @Override
                        public String getProtocol() {
                            return urlToTest.getProtocol();
                        }
                    };

                    // Weak Password found
                    if (httpAuthAttemptResponse.getStatusCode() == 200) {
                        stdout.println("[!] Weak Credentils " + user + ":" + pwd+ " on " + urlToTest);
                        CustomHttpRequestResponse result = new CustomHttpRequestResponse(
                                makeHttpRequest,
                                responseWeakPassword,
                                httpServiceInstance);


                        PassiveScanner.scanVulnerabilities(result, callbacks);