gand3lf/semgrepper

An extension to use Semgrep inside Burp Suite.

▶️ Semgrepper

The current project provides a Burp Suite extension to allow users to include Semgrep results to extend the checks in use by the passive scanner. By visiting repositories that collect Semgrep rules, it is possible to verify the large number of rules related to the front-end environment written by the community, such as: https://github.com/returntocorp/semgrep-rules/tree/develop/javascript.

By using this plugin, Burp Suite users can include the Semgrep rules YAML files and define the scope of the analysis, as shown in the following screenshot:

Main features

This is what Semgrepper implements:
   ✔️ multiple tabs to use different Semgrep rules with different scopes
   ✔️ select files or directories containing Semgrep rules in YAML format
   ✔️ define a scope by specifing what can be or not be present in the response header/body
   ✔️ deactivate the checks without unloading the plugin

Prerequisites

The plugin needs that Semgrep CLI is installed in your machine.
Please, follow these instructions to install Semgrep:

• For Ubuntu, Windows through Windows Subsystem for Linux (WSL), Linux, macOS

  python3 -m pip install semgrep

• For macOS

  brew install semgrep

Tutorial

1. Add the Semgrepper extension to Burp Suite.
2. From the section "Rules Files", select the Semgrep rules you want to use.
3. From the section "Scope", it is possible to configure some constraints to apply or not a rule to a specific response.
   
4. Enable the rules by toggling the button "Current Semgrepper is off/on".
   
5. Passively scan the target host.

Special thanks

• Giovanni Fazi

Current status

License	Compatibility

semgrepper's Issues

semgrep not getting detected on MacOS

This is in reference to this comment/issue #1 (comment)

It seems that you don't have Semgrep installed!

Please, follow these instructions to install it:
 • Ubuntu, Windows through Windows Subsystem for Linux (WSL), Linux, macOS:
     python3 -m pip install semgrep
 • macOS:
     brew install semgrep

I tried the jar file you created and it didnt work

how to use in windows?

I have already set up and exported the environment variable for semgrep in Windows WSL. ：

It still prompts.

nothing output:

another bug

i'm try to add a rule for semgrep :It seems that the path is incorrect

semgrep not getting detected

Thanks for keeping it open source.

On macOS, semgrep is installed using brew

But not getting detected by the extension:

there is no error in the import and I have tried by removing and adding it again but still the same.

uname -a output:
Darwin MacBook-Pro 22.3.0 Darwin Kernel Version 22.3.0: Sun Dec 4 18:16:43 PST 2022; root:xnu-8792.80.21.0.2~9/RELEASE_ARM64_T8103 arm64