http_request +"connectionclose\ \nhttp_request +"authorizationbasic % \ \nbase encode(":%sbing_api_keyhttp_request +"user-agentblackhat python\ \ \ \njson_body self _callbacks makehttprequest("api datamarket azure com" ,true,http_requesttostring(json_body json_body split("\ \ \ \ ", )[ tryr json loads(json_bodyif len( [" "]["results"])for site in [" "]["results"]print "* print site['title'print site['url'print site['description'print "* j_url url(site['url']if not self _callbacks isinscope(j_url)print "adding to burp scopeself _callbacks includeinscope(j_urlexceptprint "no results from bingpass return okayburp' http api requires that we build up the entire http request as string before sending it offand in particular you can see that we need to base -encode our bing api key and use http basic authentication to make the api call we then send our http request to the microsoft servers when the response returnswe'll have the entire response including the headersso we split the headers off and then pass it to our json parser for each set of resultswe output some information about the site that we discovered and if the discovered site is not in burp' target scope we automatically add it this is great blend of using the jython api and pure python in burp extension to do additional recon work when attacking particular target let' take it for spin