when you're attacking web serverit' not uncommon for that single machine to serve several web applicationssome of which you might not be aware of of courseyou want to discover these hostnames exposed on the same web server because they might give you an easier way to get shell it' not rare to find an insecure web application or even development resources located on the same machine as your target microsoft' bing search engine has search capabilities that allow you to query bing for all websites it finds on single ip address (using the "ipsearch modifierbing will also tell you all of the subdomains of given domain (using the "domainmodifiernow we couldof courseuse scraper to submit these queries to bing and then scrape the html in the resultsbut that would be bad manners (and also violate most search enginesterms of usein order to stay out of troublewe can use the bing api[ to submit these queries programmatically and then parse the results ourselves we won' implement any fancy burp gui additions (other than context menuwith this extensionwe simply output the results into burp each time we run queryand any detected urls to burp' target scope will be added automatically because already walked you through how to read the burp api documentation and translate it into pythonwe're going to get right to the code crack open bhp_bing py and hammer out the following codefrom burp import iburpextender from burp import icontextmenufactory from javax swing import jmenuitem from java util import listarraylist from java net import url import socket import urllib import json import re import base bing_api_key "yourkeyclass burpextender(iburpextendericontextmenufactory)def registerextendercallbacks(selfcallbacks)self _callbacks callbacks self _helpers callbacks gethelpers(self context none we set up our extension callbacks setextensionname("bhp bing"callbacks registercontextmenufactory(selfreturn def createmenuitems(selfcontext_menu)self context context_menu menu_list arraylist(menu_list add(jmenuitem("send to bing"actionperformed=self bing_ menu)return menu_list this is the first bit of our bing extension make sure you have your bing api key pasted in place you are allowed something like , free searches per month we begin by defining our burpextender class that implements the standard iburpextender interface and the icontextmenufactorywhich allows us to provide context menu when user right-clicks request in burp we register our menu handler so that we can determine which site the user