Testing and Debugging

[soffensive]

How do you test and / or debug the extension?
I am currently trying to make it work and add features

[luh2]

I currently test manually. Debugging with print statements. I get around quite quick. It would be nice to have a proper test setup though. Do you have something in mind, that goes well with burp extensions?

[soffensive]

Unfortunately, I think Java extensions would be easier to debug than Python extensions.
Do you have a standard vulnerable app you use for testing? I tried Google Gruyere and found that the extension did not report the XSSI vulnerability, which is why I became curious in the first place and started digging in the extension's source code.
It seems that the extension has not worked since at least July 2016 (commit 99ea4de)

Overall, I would suggest that before releasing a version it should be tested against a range of known vulnerabilities on a constructed web app.

[luh2]

I haven't looked at proper test suits for Burp Jython extensions, but if you have something that would be working, I am open. Does Gruyere have XSSI vulnerabilities, maybe that could be an option for testing.