正常安装插件，ai检测功能无法使用

[widylan]

at org.python.pycode.pyx4.processHttpMessage$3(AutorizePro-1.4/AutorizePro.py:39)
at org.python.pycode.pyx4.call_function(AutorizePro-1.4/AutorizePro.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:306)
at org.python.core.PyBaseCode.call(PyBaseCode.java:197)
at org.python.core.PyFunction.call(PyFunction.java:485)
at org.python.core.PyMethod.instancemethod___call(PyMethod.java:237)
at org.python.core.PyMethod.call(PyMethod.java:228)
at org.python.core.PyMethod.call(PyMethod.java:218)
at org.python.core.PyMethod.call(PyMethod.java:213)
at org.python.core.PyObject.jcallexc(PyObject.java:3565)
at org.python.core.PyObject.jcall(PyObject.java:3598)
at org.python.proxies.main$BurpExtender$24.processHttpMessage(Unknown Source)
at burp.Zwos.handleHttpResponseReceived(Unknown Source)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at burp.Zadn.invoke(Unknown Source)
at jdk.proxy2/jdk.proxy2.$Proxy61.handleHttpResponseReceived(Unknown Source)
at burp.Zvx2.ZA(Unknown Source)
at burp.Zyyu.ZA(Unknown Source)
at burp.Zws.ZA(Unknown Source)
at burp.Zewo.ZM(Unknown Source)
at burp.Zdtz.ZS(Unknown Source)
at burp.Zdtl.ZC(Unknown Source)
at burp.Zdt8.Ze(Unknown Source)
at burp.Zdtz.Ze(Unknown Source)
at burp.Zyfj.ZR(Unknown Source)
at burp.Zact.ZA(Unknown Source)
at burp.Zact.ZO(Unknown Source)
at burp.Zact.Zr(Unknown Source)
at burp.Za8f.Zr(Unknown Source)
at burp.Zdmk.Zr(Unknown Source)
at burp.Zy9g.Zr(Unknown Source)
at burp.Zdg.ZS(Unknown Source)
at burp.Zy8k.Zb(Unknown Source)
at burp.Zy8j.Zb(Unknown Source)
at burp.Zzt7.Zj(Unknown Source)
at burp.Zesa.Zo(Unknown Source)
at burp.Zd_x.ZE(Unknown Source)
at burp.Zd_x.Ze(Unknown Source)
at burp.Zehj.Zy(Unknown Source)
at burp.Zehj.ZH(Unknown Source)
at burp.Ze_d.Zc(Unknown Source)
at burp.Za_u.ZB(Unknown Source)
at burp.Za_u.Zx(Unknown Source)
at burp.Za_u.run(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1570)
java.net.SocketException: Connection reset
at java.base/sun.nio.ch.NioSocketImpl.implRead(NioSocketImpl.java:318)
at java.base/sun.nio.ch.NioSocketImpl.read(NioSocketImpl.java:346)
at java.base/sun.nio.ch.NioSocketImpl$1.read(NioSocketImpl.java:796)
at java.base/java.net.Socket$SocketInputStream.implRead(Socket.java:1108)
at java.base/java.net.Socket$SocketInputStream.read(Socket.java:1095)
at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:489)
at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:483)
at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1507)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1422)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:586)
at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187)
at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1460)
at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1423)
at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:219)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at org.python.core.PyReflectedFunction.call(PyReflectedFunction.java:190)
at org.python.core.PyReflectedFunction.call(PyReflectedFunction.java:208)
at org.python.core.PyObject.call(PyObject.java:461)
at org.python.core.PyObject.call(PyObject.java:465)
at org.python.core.PyMethod.call(PyMethod.java:126)
at authorization.authorization$py.request_dashscope_api$20(AutorizePro-1.4/authorization/authorization.py:586)
at authorization.authorization$py.call_function(AutorizePro-1.4/authorization/authorization.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:306)
at org.python.core.PyFunction.function___call_(PyFunction.java:474)
at org.python.core.PyFunction.call(PyFunction.java:469)
at org.python.core.PyFunction.call(PyFunction.java:459)
at authorization.authorization$py.call_dashscope_api$19(AutorizePro-1.4/authorization/authorization.py:512)
at authorization.authorization$py.call_function(AutorizePro-1.4/authorization/authorization.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:306)
at org.python.core.PyFunction.function___call__(PyFunction.java:474)
at org.python.core.PyFunction.call(PyFunction.java:469)
at org.python.core.PyFunction.call(PyFunction.java:459)
at authorization.authorization$py.checkBypass$13(AutorizePro-1.4/authorization/authorization.py:359)
at authorization.authorization$py.call_function(AutorizePro-1.4/authorization/authorization.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:306)
at org.python.core.PyFunction.function___call__(PyFunction.java:474)
at org.python.core.PyFunction.call(PyFunction.java:469)
at org.python.core.PyFunction.call(PyFunction.java:459)
at authorization.authorization$py.checkAuthorization$21(AutorizePro-1.4/authorization/authorization.py:649)
at authorization.authorization$py.call_function(AutorizePro-1.4/authorization/authorization.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:187)
at org.python.core.PyFunction.call(PyFunction.java:449)
at authorization.authorization$py.handle_message$9(AutorizePro-1.4/authorization/authorization.py:231)
at authorization.authorization$py.call_function(AutorizePro-1.4/authorization/authorization.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:187)
at org.python.core.PyFunction.call(PyFunction.java:449)
at org.python.pycode.pyx4.processHttpMessage$3(AutorizePro-1.4/AutorizePro.py:39)
at org.python.pycode.pyx4.call_function(AutorizePro-1.4/AutorizePro.py)
at org.python.core.PyTableCode.call(PyTableCode.java:173)
at org.python.core.PyBaseCode.call(PyBaseCode.java:306)
at org.python.core.PyBaseCode.call(PyBaseCode.java:197)
at org.python.core.PyFunction.call(PyFunction.java:485)
at org.python.core.PyMethod.instancemethod___call(PyMethod.java:237)
at org.python.core.PyMethod.call(PyMethod.java:228)
at org.python.core.PyMethod.call(PyMethod.java:218)
at org.python.core.PyMethod.call(PyMethod.java:213)
at org.python.core.PyObject._jcallexc(PyObject.java:3565)
at org.python.core.PyObject.jcall(PyObject.java:3598)
at org.python.proxies.main$BurpExtender$24.processHttpMessage(Unknown Source)
at burp.Zwos.handleHttpResponseReceived(Unknown Source)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at burp.Zadn.invoke(Unknown Source)
at jdk.proxy2/jdk.proxy2.$Proxy61.handleHttpResponseReceived(Unknown Source)
at burp.Zvx2.ZA(Unknown Source)
at burp.Zyyu.ZA(Unknown Source)
at burp.Zws.ZA(Unknown Source)
at burp.Zewo.ZM(Unknown Source)
at burp.Zdtz.ZS(Unknown Source)
at burp.Zdtl.ZC(Unknown Source)
at burp.Zdt8.Ze(Unknown Source)
at burp.Zdtz.Ze(Unknown Source)
at burp.Zyfj.ZR(Unknown Source)
at burp.Zact.ZA(Unknown Source)
at burp.Zact.ZO(Unknown Source)
at burp.Zact.Zr(Unknown Source)
at burp.Za8f.Zr(Unknown Source)
at burp.Zdmk.Zr(Unknown Source)
at burp.Zy9g.Zr(Unknown Source)
at burp.Zdg.ZS(Unknown Source)
at burp.Zy8k.Zb(Unknown Source)
at burp.Zy8j.Zb(Unknown Source)
at burp.Zzt7.Zj(Unknown Source)
at burp.Zesa.Zo(Unknown Source)
at burp.Zd_x.ZE(Unknown Source)
at burp.Zd_x.Ze(Unknown Source)
at burp.Zehj.Zy(Unknown Source)
at burp.Zehj.ZH(Unknown Source)
at burp.Ze_d.Zc(Unknown Source)
at burp.Za_u.ZB(Unknown Source)
at burp.Za_u.Zx(Unknown Source)
at burp.Za_u.run(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1570)

以上是报错信息
bp版本2021.11.2 jpython2.7.3
ai检测列表一直为空，从未进行检测

[sule01u]

师傅你好，看报错是https的握手过程异常，可以私信不懂安全公众号发送你的微信号，我加你排查一下

[sule01u]

无法复现未解决，等一个有缘的师傅遇到同样问题并解决的，欢迎提交解决方案。

[m4ra7h0n]

控制台未报错，尝试了换jython为最新，jdk版本为22，更换千问的key，都没有发出ai请求。去千问控制台查看没有发出请求。 并且Authz Status一栏和原先插件不同，origin和modify响应len相同情况不应该是越权成功了么。 老插件的结果是这样的

[sule01u]

控制台未报错，尝试了换jython为最新，jdk版本为22，更换千问的key，都没有发出ai请求。去千问控制台查看没有发出请求。 并且Authz Status一栏和原先插件不同，origin和modify响应len相同情况不应该是越权成功了么。 老插件的结果是这样的

师傅你好，感谢你的反馈，之前理解有点错误，仔细看了一下图中情况是符合工具预期的；结合当前市场主要的接口情况，插件目前只判断响应为json、xml格式的，状态码目前也只关注2xx, 3xx，不符合这些情况的直接会被判定为非越权； 其他的才会正式进入越权判断，其中只有长度在50-7000之内的响应才会被AI进行分析（节约AI调用成本），你可以多在众测、src资产测试看看应该是比较符合实战的。

经过你的充分使用之后，欢迎回来补充对工具的建议来提升准确率。