HaE: A Refined Framework for Marking and Extracting HTTP Messages

01 · Project Overview: A Truly Efficient “Building Block” Message Parsing Framework

The core concept of HaE is very clear:

Use rules to let HTTP messages expose their key points.

Rules (Rule Management)

It has three core capabilities:

✔ Precise Matching: Custom Regex + Multi-Engine (NFA/DFA) Support

Ordinary Burp can only perform simple matching, while HaE allows users to write a “rule chain”:

F-Regex: Initial matching
S-Regex: Secondary extraction of results
Precision down to group extraction, formatting, and color marking

It can be called an “HTTP Information Filter”.

✔ Modular Design: Expand Rules Like Building Blocks

The essence of HaE rules is a YML file, with 8 clearly defined and controllable fields.

For example, if you want to identify Shiro rememberMe:

Ordinary matching:

rememberMe=delete

HaE rules must be written as:

(rememberMe=delete)

The reason is that the parentheses represent extraction points, and HaE will automatically highlight this field and summarize it in the Databoard.

✔ Practical Scenario Orientation: Highlighting Truly Important Messages Early

It will perform the following in Burp messages:

Color highlighting
Field annotations
Extract key values
Summarize to the data dashboard

The effect is like: Your Burp will actively remind you—”Hey, this message has something!”

In medium to large penetration projects, the efficiency improvement is particularly significant.

02 · HaE’s Rule System: 8 Fields Supporting a Framework

The rule fields are as follows:

Field	Meaning
Name	Rule Name
F-Regex	First Regex Match (must use parentheses () to mark extraction content)
S-Regex	Secondary Match, optional
Format	Output format, can use groups like {0}
Scope	Matching scope: request/response/header/body/full message
Engine	Regex engine: DFA (fast)/NFA (more features)
Color	Matching highlight color, with a “color upgrade algorithm”
Sensitive	Case sensitivity

Especially the color upgrade algorithm is very clever—it avoids “color collisions” when multiple rules hit simultaneously by automatically upgrading color priority.

03 · Installation and Configuration: Fully Adopting Montoya API from 3.0

Installation Process (Simple Version)

BurpSuite version ≥ 2023.12.1
Extender → Extensions → Add
Select HaE Jar → Load successfully
Click Reinit to initialize the rule library (will read built-in rules from the Jar package)

Configuration file location:

Linux/Mac: ~/.config/HaE/
Windows: %USERPROFILE%/.config/HaE/
Or place in the same directory as the Jar /.config/HaE/(suitable for mobile office)

04 · HaE’s 4 Major Interfaces: The Real Efficiency Boost

1) Rules — Rule Management Panel

View, add, delete, and edit rules
Import/Export
Clear visibility of rule effectiveness scope

2) Config — Configuration Management

Global settings
Regex engine selection
Output style and sensitivity settings

3) Databoard — Data Dashboard (The Real Core of Efficiency)

HaE will summarize all content that hits the rules into one panel.

For example:

JWT
URL Parameters
Keys/Tokens
Sensitive Paths
Business Critical Fields

No need to search through hundreds of messages, HaE has already extracted them for you.

4) MarkInfo — Message Highlight Display Area

Here you can see:

Which rule was hit
What the matching content is
Where in the original message was highlighted

Very suitable for review and vulnerability localization.

05 · Summary of Advantages (Based on Practice)

✔ Significantly Reduces Time Spent on Invalid Message Analysis

Truly focuses energy on valuable requests.

✔ Practical Rule Library with High Hit Rate

The official rules are based on actual penetration scenarios.

✔ Centralized Information Presentation, Convenient for Reporting and Review

Databoard is your “Vulnerability Intelligence Center”.

✔ Very Effective for Large Projects and High Traffic Scenarios

Such as:

Red Team Operations
Large Web Platform Penetration
API Interface Testing
Automated Crawlers + Traffic Analysis

06 · Why is HaE Recommended by KCon and GitCode?

HaE was selected:

2022 KCon Weapon List
GitCode G-Star Project

The reason is simple: it addresses the real pain points in penetration testing.

Unlike some plugins that merely add embellishments, HaE is—a weapon in the hands of the strong, and can also quickly improve efficiency for newcomers.

07 · Finally: Who is the Most Suitable Audience for HaE?

Web Penetration Testers
Red Team/Attack-Defense Drill Members
Security Developers/Security Operations
Web Traffic Analysts
API Security Researchers

If you have ever spent a long time searching for a parameter in Burp, then you definitely need HaE.