Skip to content
BranchesTags

Repository files navigation

HL735TER - HL7 Security Testing Extension for Burp Suite

Advanced HL7 fuzzing and security analysis capabilities for healthcare applications

Overview

HL735TER is a comprehensive Burp Suite extension for security testing of HL7 (Health Level 7) healthcare messaging systems. It provides intelligent HL7 message parsing, automatic vulnerability detection, and targeted fuzzing capabilities.

Key Features

Intelligent HL7 Detection

  • Automatic detection of HL7 messages in HTTP requests/responses
  • Supports both raw HL7 and JSON-embedded HL7 messages
  • Recognizes all HL7 v2.5/2.7 message types (ADT, OML, ORU, ORM, etc.)

HL7 Message Analysis

  • Converts HL7 messages to readable JSON format
  • Detailed field descriptions and hierarchical structure
  • Interactive editing with automatic conversion back to HL7

Advanced Security Testing

  • 8 Specialized Payload Generators for targeted attacks
  • Automatic Position Marking for Intruder fuzzing
  • Context-Aware Escaping for JSON-embedded HL7
  • Field Classification (protected vs. fuzzable)

Payload Categories (10 Specialized Generators)

1. HL7 Buffer Overflow (14 payloads)

  • Length-based attacks testing field size limits
  • Various character patterns and overflow scenarios

2. HL7 SQL Injection (Safe) (30 payloads)

  • SAFE ONLY - No destructive operations
  • Information gathering and logic testing
  • Healthcare database context awareness

3. HL7 XSS Attacks (21 payloads)

  • Web interface injection testing
  • Healthcare context XSS scenarios
  • Filter bypass techniques

4. HL7 Format Strings (18 payloads)

  • Memory corruption testing
  • Format string vulnerability detection

5. HL7 Separator Elements (25 payloads)

  • HL7-specific separator manipulation
  • Field structure corruption testing
  • Component separator abuse

6. HL7 Unicode Attacks (25 payloads)

  • Encoding bypass testing
  • Control character injection
  • Unicode normalization attacks

7. HL7 Healthcare Context (42 payloads)

  • Medical terminology injection
  • Healthcare-specific test scenarios
  • Patient data manipulation testing

8. HL7 Special Characters (30 payloads)

  • Reserved string testing
  • Edge case handling
  • Healthcare-specific reserved words

9. HL7 Authority Spoofing (42 payloads)

  • Healthcare system impersonation
  • Authority identifier manipulation
  • OID and namespace attacks
  • Application/facility spoofing

10. HL7 Component Attacks (65 payloads)

  • Component separator injection
  • Sub-component manipulation
  • Empty component exploitation
  • Healthcare code injection

Quick Start

Installation

  1. Copy the HL735TER folder to your Burp extensions directory
  2. In Burp Suite: Extender → Extensions → Add
  3. Select Python and choose HL735TER.py
  4. Verify successful loading in the Extender Output

Basic Usage

1. HL7 Message Analysis

  • Browse to any HTTP message containing HL7 content
  • Look for the "HL7 JSON" tab in the message editor
  • View the converted JSON representation

2. Security Testing

  • Right-click on requests with HL7 content
  • Select "Test HL7 Detection" to analyze HL7 content (results in Extender Output)
  • Select "Send to Intruder (HL7 configured)" for fuzzing (status in Extender Output)
  • In Intruder, choose from 10 specialized payload types
  • Configure attack and run security tests

Advanced Features

Penetration Testing Field Classification

# MINIMAL EXCLUSIONS - Only what breaks parsing completely
PROTECTED_FIELDS = {
    'MSH': {1, 2},  # ONLY field separator and encoding chars
}

# MAXIMUM ATTACK SURFACE - Everything else is a security target
FUZZABLE_FIELDS = {
    'MSH': [3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21],  # ALL routing/control
    'PID': [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20], # ALL patient data
    'EVN': [1,2,3,4,5,6,7],     # ALL event control - security targets
    'ORC': [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20], # ALL order control
    # ... comprehensive security-focused mapping
}

Context-Aware Escaping

# JSON Context: HL7 embedded in JSON
payload = '<script>alert(1)</script>'
escaped = '<script>alert(1)<\\/script>'

# Dual Context: JSON + HL7 separator awareness
payload = '^INJECTION^'
safe_payload = '^INJECTION^'  # Preserved for HL7 testing

JSON Safety

All payloads are automatically escaped for JSON contexts:

  • Double quotes: " → \"
  • Backslashes: \ → \\
  • Control chars: \r → \\r, \n → \\n

Security Testing Workflow

1. Detection Phase

Right-click → Test HL7 Detection
  • Verifies HL7 content presence
  • Shows the actual HL7 message payload in Extender Output
  • Displays formatted HL7 segments for analysis
  • No popup dialogs - all results in Extender Output tab

2. Enhanced Position Marking

Right-click → Send to Intruder (HL7 configured)
  • HIERARCHICAL INJECTION POINTS: Field, Component, Sub-component, Repetition levels
  • PENETRATION TESTING FOCUSED: Minimal exclusions (only MSH.1, MSH.2)
  • ENHANCED COVERAGE: Typically marks 100+ positions per HL7 message
  • AUTOMATIC EMPTY FIELD SUPPORT: Creates insertion points for empty fields (||)
  • AUTOMATIC EMPTY COMPONENT SUPPORT: Creates insertion points for empty components (^^) and sub-components (&&)
  • Uses payloadPositionOffsets for precise marking
  • Sends directly to Intruder with positions configured
  • NO POPUP DIALOGS: All status and results in Extender Output tab

3. Targeted Testing

Intruder → Positions → Payloads → Select Generator

Choose from 10 specialized generators:

  • Buffer Overflow: Test field length limits
  • SQL Injection: Database security (safe only)
  • XSS: Web interface vulnerabilities
  • Format Strings: Memory corruption
  • HL7 Elements: Message structure integrity
  • Unicode: Encoding vulnerabilities
  • Healthcare Context: Medical system specific
  • Special Characters: Edge case handling
  • Authority Spoofing: Healthcare system impersonation
  • Component Attacks: Component/sub-component exploitation

4. Attack Execution

Intruder → Attack Type → Start Attack
  • Sniper: Test each position individually (recommended)
  • Battering Ram: Same payload in all positions
  • Pitchfork: Different payloads per position
  • Cluster Bomb: All payload combinations

Healthcare-Specific Security Testing

Patient Identity Attacks

  • Authority Spoofing: Test PID.3.4 (Assigning Authority) manipulation
  • Identifier Type Confusion: Test PID.3.5 component attacks
  • Cross-Patient Data Access: Test patient ID boundary validation
  • Identity Theft Scenarios: Test patient identifier injection

Message Routing Attacks

  • Sender Spoofing: Test MSH.3/MSH.4 (Sending App/Facility) manipulation
  • Receiver Hijacking: Test MSH.5/MSH.6 (Receiving App/Facility) redirection
  • Message Type Confusion: Test MSH.9 component manipulation
  • Processing Control Bypass: Test MSH.11 (Processing ID) attacks

Medical Code Injection

  • ICD-10 Code Manipulation: Test diagnostic code injection
  • CPT Code Attacks: Test procedure code manipulation
  • LOINC Code Injection: Test laboratory code attacks
  • Drug Code Manipulation: Test medication identifier attacks

Order Control Attacks

  • Order Hijacking: Test ORC.1 (Order Control) manipulation
  • Order Number Injection: Test ORC.2/ORC.3 attacks
  • Provider Spoofing: Test ordering provider field attacks
  • Workflow Manipulation: Test order status control attacks

Enhanced Security Testing Features

Hierarchical Injection Points

Example HL7 Field: PID.3 = "12345^^^HOSPITAL&1.2.3.4.5&ISO^MR"

INJECTION LEVELS:
├── Field Level:        [Full field injection]
├── Component Level:    [12345] [^^] [HOSPITAL&1.2.3.4.5&ISO] [MR]
├── Sub-component Level: [HOSPITAL] [1.2.3.4.5] [ISO]
├── Empty Components:   [^^] automatic insertion points
└── Empty Sub-components: [&&] automatic insertion points

Example Empty Field: MSH|^~\&|App|Fac||Target|
└── Empty Field Insertion: [||] automatic insertion point

Penetration Testing Philosophy

  • MINIMAL EXCLUSIONS: Only MSH.1 (|) and MSH.2 (^~&) excluded
  • MAXIMUM ATTACK SURFACE: All other fields are security targets
  • AUTHORITY TESTING: Patient ID authorities, message routing, system identification
  • CONTROL FLOW TESTING: Message types, processing IDs, order controls
  • EMPTY COMPONENT EXPLOITATION: Tests parser handling of empty positions

Real-World Attack Scenarios

BEFORE: PID|||12345^^^HOSPITAL&1.2.3.4.5&ISO^MR
ATTACK: PID|||12345^^^EVIL_HOSP&9.9.9.9.9&BYPASS^XX

IMPACT: 
• Patient routed to wrong authority system
• Identity validation bypassed  
• Cross-system data exposure
• Unauthorized access to patient records

Safety Features

Non-Destructive Testing

  • No DROP TABLE statements
  • No DELETE operations
  • No file system destruction
  • Safe information gathering only

Healthcare Compliance

  • HIPAA-aware testing scenarios
  • Medical terminology context
  • Healthcare system specific payloads

Supported HL7 Segments

  • MSH: Message Header
  • PID: Patient Identification
  • PV1: Patient Visit
  • OBX: Observation/Result
  • ORC: Common Order
  • OBR: Observation Request
  • SPM: Specimen
  • NTE: Notes and Comments
  • AL1: Patient Allergy Information
  • DG1: Diagnosis

Technical Implementation

Core Architecture

  • Main Extension: HL735TER.py - Burp Suite integration and HL7 parsing
  • Security Engine: hl7_intruder_simple.py - Fuzzing and payload generation
  • Parser Library: hl7_parser_standalone.py - HL7 message parsing

Enhanced Hierarchical Position Marking

  • MULTI-LEVEL INJECTION: Field, Component, Sub-component, Repetition levels
  • PENETRATION TESTING OPTIMIZED: Minimal exclusions (only MSH.1, MSH.2)
  • AUTOMATIC EMPTY FIELD SUPPORT: Creates insertion points for empty fields (||)
  • AUTOMATIC EMPTY COMPONENT SUPPORT: Tests empty components (^^) and sub-components (&&)
  • Uses Burp's sendToIntruder(host, port, https, content, payloadPositionOffsets)
  • Calculates precise byte offsets for hierarchical injection points
  • Creates Java int[] arrays for proper Intruder integration
  • Supports both JSON-embedded and raw HL7 content
  • ENHANCED COVERAGE: 100+ injection points per typical HL7 message

JSON-Safe Payload Processing

def _make_json_safe(self, payload):
    safe_payload = payload.replace('\\', '\\\\')    # Escape backslashes
    safe_payload = safe_payload.replace('"', '\\"') # Escape quotes
    safe_payload = safe_payload.replace('\r', '\\r') # Escape CR
    safe_payload = safe_payload.replace('\n', '\\n') # Escape LF
    return safe_payload

Requirements

  • Burp Suite Professional (for Intruder functionality)
  • Python/Jython support in Burp
  • hl7tojson parser library (included)

File Structure

HL735TER/
├── HL735TER.py                    # Main extension file
├── hl7_intruder_simple.py         # Security testing engine
├── hl7_parser_standalone.py       # HL7 parser
└── README.md                      # This file

Getting Started

Installation Steps

  1. Download: Copy the HL735TER folder to your system
  2. Load Extension: In Burp Suite → Extender → Extensions → Add
  3. Select Type: Choose Python extension type
  4. Browse: Select HL735TER.py from the HL735TER folder
  5. Verify: Check Extender Output for successful loading message

Usage Workflow

  1. Find HL7 Content: Look for "HL7 JSON" tabs in message editors
  2. Test Detection: Right-click → "Test HL7 Detection" to verify and view HL7 content
  3. Security Test: Right-click → "Send to Intruder (HL7 configured)" for fuzzing
  4. Choose Payloads: Select from 8 specialized payload generators in Intruder
  5. Configure Attack: Choose attack type (Sniper recommended for HL7)
  6. Run Tests: Execute attack and analyze results for vulnerabilities

Expected Output

Extension Loading:
✅ HL735TER extension loaded successfully!
✅ HL7 parser is available and ready (using full parser).
✅ HL7 security testing capabilities enabled!
✅ Registered HL7 payload generator: HL7 Buffer Overflow
✅ Registered HL7 payload generator: HL7 SQL Injection (Safe)
... (8 generators total)

Example Attack Scenarios

SQL Injection Testing

-- Safe information gathering
' UNION SELECT version(),user(),database()--
' OR 1=1 ORDER BY 1--
' AND 1=(SELECT COUNT(*) FROM information_schema.tables)--

XSS Testing

<!-- Healthcare context XSS -->
<script>alert('Patient Data Test')</script>
<img src=x onerror=alert('Medical Interface')>
<script>alert('HL7 System Test')</script>

HL7 Structure Testing

# Separator manipulation
^^^INJECTION^^^
~~~INJECTION~~~
^~\&|^~\&|

Advanced Capabilities

Intelligent Position Detection

  • 26+ Position Detection: Automatically finds all fuzzable HL7 fields
  • Field Classification: Protects critical structure fields (MSH.1, MSH.2, etc.)
  • Extended Field Support: Handles high field numbers (ORC.25, SPM.20+)
  • Precise Offset Calculation: Uses payloadPositionOffsets for accurate marking

Context-Aware Payloads

  • JSON-Safe Payloads: All 200+ payloads work in JSON-embedded contexts
  • Healthcare Intelligence: Medical system aware testing scenarios
  • Safe Operations: No destructive payloads included
  • Specialized Targeting: 8 distinct attack categories

Professional Features

  • Individual Generators: Separate payload types for targeted testing
  • Streamlined Interface: Direct context menu access (no nested menus)
  • Real-time Analysis: Shows actual HL7 message in detection test
  • Production Ready: Clean, minimal file structure

Security Testing Excellence

  • Comprehensive Coverage: 200+ specialized attack vectors
  • Healthcare Focus: HIPAA-aware, medical terminology context
  • Safe Testing: Information gathering only, no system damage
  • Expert Classification: Based on HL7-Fuzzer research and security best practices

Context Menu Reference

Available Options (Right-click on HL7 requests)

├── Test HL7 Detection           # Analyze and display HL7 content
└── Send to Intruder (HL7 configured)  # Send to Intruder with positions marked

Detection Test Output

HL7 Detected: True

HL7 Message:
MSH|^~\&|TestLIS|TestFacility|AISighttt|PathAI|20250917133407||OML^O21^OML_O21|...
PID|1||7b3bb6c8-372b-4854-847f-de208e639f50^^^2804d476-d509-41ec-89ac-b7635b05b13d^^...
ORC|NW||TEST-732||||||20250917133407||||||||||||||||open^^PathAI
OBR|1
SPM|1|^TEST-971;A;1;1|A;1|TestTissue|H\T\E||Biopsy|TestTissue|||||||||20250917133407|...

Troubleshooting

Extension Not Loading

  • Verify Python support is enabled in Burp Suite
  • Check that all files are in the same HL735TER folder
  • Review Extender Output for error messages

No HL7 Detection

  • Ensure request contains MSH| segment
  • Check for JSON field names: hl7_message, hl7Message, message
  • Verify HL7 message format is valid

No Positions Marked in Intruder

  • Confirm HL7 content was detected first
  • Check that fuzzable fields contain data (not empty)
  • Verify using "Test HL7 Detection" before sending to Intruder

Payload Generator Not Available

  • Reload extension if generators don't appear
  • Check Extender Output for registration messages
  • Verify Burp Suite Professional (required for custom generators)

Version: 1.0

About

HL735TER is a comprehensive Burp Suite extension for security testing of HL7 (Health Level 7) healthcare messaging systems. It provides intelligent HL7 message parsing, automatic vulnerability detection, and targeted fuzzing capabilities.

Resources

Readme
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Used by

Contributors

Languages