Conditional Match and Replace (CMAR)
An extension allowing you to create match and replace operations that execute only when a condition is matched (or not matched). The condition can be matched against the request Header/Body/All, or the response Header/Body/All. If the condition is matched, you can apply a match and replace rule against the specified area. You can create a condition that matches a request, then performs a match and replace in the response.
CMARs work in a chain, updating the request/response then moving to the next rule. If you have a CMAR that changes a request, and the subsequent rule matches a condition that was only present before the match and replace, it will not fire.
Conditions support regex and literal matching, as does the match and replace function.
- Changing caching on some files
- Adding request headers (such as Authorization) to only some requests
- Alter a common string in the response for only some pages/targets.
- Change the target host or port a request is sent to
gradle build outputs the jar into build/libs/cmar.jar.
CMAR only has one dependency, for the Burp Extender API (version 2.3), which all Burp Apps require. This is available in a Maven repository and should be fetched automatically if you use gradle to build. The hash for this jar is verified in newer versions of gradle.
- allow multiple conditions for a match
- regex for target port during replace
Tests can be run by setting runTests = true in the BurpExtender.java file. Leave this disabled normally.