diff options
Diffstat (limited to 'PLUGINS.md')
| -rw-r--r-- | PLUGINS.md | 22 |
1 files changed, 13 insertions, 9 deletions
@@ -11,15 +11,19 @@ Go), and means a plugin can be developed and tested against the exact same socket the TUI is already using, with `mitmux` itself open in another terminal watching what happens in real time. -`plugins/authcheck`, `plugins/paramminer`, and `plugins/jslibscan` are -real, working reference implementations - an Autorize-style -authorization checker (resends a captured request with its auth header -stripped, tags the entry if the response still succeeds), a Param -Miner-style hidden parameter prober (probes a small wordlist of -candidate query parameters, tags the entry if any noticeably change the -response), and a Retire.js-style passive scanner for known-vulnerable -JS library versions (reads response bodies already captured by ordinary -proxying, no probing at all) - all written to only ever exercise what's +`plugins/authcheck`, `plugins/paramminer`, `plugins/jslibscan`, and +`plugins/bpscanner` are real, working reference implementations - an +Autorize-style authorization checker (resends a captured request with +its auth header stripped, tags the entry if the response still +succeeds), a Param Miner-style hidden parameter prober (probes a small +wordlist of candidate query parameters, tags the entry if any noticeably +change the response), a Retire.js-style passive scanner for +known-vulnerable JS library versions (reads response bodies already +captured by ordinary proxying, no probing at all), and a Backslash +Powered Scanner-style generic injection detector (mutates each existing +query parameter's value with syntactically-significant characters vs. an +equal-length inert control, tags the entry if a stable marker survives +one but not the other) - all written to only ever exercise what's documented on this page, not any of mitmux's own internal Go packages, specifically so they prove this protocol is sufficient on its own. Worth reading alongside this document, or just copying as a starting |