Burp Suite
Burp Suite, developed by PortSwigger, is the industry-standard toolkit for web application security testing. Used by penetration testers, bug bounty hunters, and security teams worldwide, it provides an integrated platform for the entire testing workflow — from mapping an application's attack surface to finding and exploiting vulnerabilities.
At its core, Burp Suite acts as an intercepting proxy that sits between the browser and the target application, allowing testers to inspect, modify, and replay HTTP/HTTPS traffic in real time. Key tools include the Repeater for manual request manipulation, Intruder for automated parameter fuzzing, Scanner for automated vulnerability detection, and Sequencer for analyzing token randomness.
Burp's extensibility is one of its greatest strengths. The BApp Store offers hundreds of community-built extensions, and the Extender API allows custom plugins in Java, Python (via Jython), and Montoya API. Common extensions add capabilities like active scanning enhancements, authentication handling, and integration with other security tools.
PortSwigger also maintains the Web Security Academy — one of the best free resources for learning web security, with interactive labs that pair directly with Burp Suite testing techniques.
This page collects Burp Suite tutorials, extension guides, tips and tricks, and resources for getting the most out of the tool in your security testing workflow.
From PortSwigger
Burp rewards configuration far more than clicking
Almost everyone's Burp usage plateaus in the same place: proxy the traffic, send interesting requests to Repeater, run Intruder on a parameter, repeat. That works, and it leaves most of the tool unused. The difference between casual and fluent use is almost entirely setup — scope, session handling and match-and-replace — because those are what let you point Burp at a complicated application and trust what comes back.
Scope first, and more aggressively than feels necessary. An unscoped project fills the sitemap with third-party analytics and CDN traffic, which makes the sitemap useless for the thing it is actually good at: showing you the shape of an application you have not fully explored. Scope well and passive crawling becomes reconnaissance.
Session handling rules are the feature that most often goes unlearned and most changes what is possible. An application with short-lived tokens, CSRF tokens bound to each form, or a re-authentication step will defeat Intruder and Scanner entirely unless Burp knows how to refresh state mid-run. Once a macro is recorded and a rule is attached to the right scope, long automated runs against authenticated functionality just work — and testing authorization, which needs two sessions driven in parallel, becomes routine.
Intruder is worth learning as four distinct attack types rather than one feature: sniper for single-parameter work, battering ram for repeating a value across positions, pitchfork for parallel lists, cluster bomb for the full product. Choosing wrong is the usual reason a run produces noise. Beyond that, the extension ecosystem is where a lot of real capability lives — Autorize for authorization testing, Turbo Intruder for request rates the built-in engine cannot reach, Logger++ for searching everything that passed through.
The material below spans configuration, extension development and workflow. If you already live in Repeater, the highest-return reading is the session handling and Autorize material.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-11-04 NEW 2026 | API-P-2: How to Find Excessive Data Exposure Using Postman and Burp Suite intermediate API Sec | This content outlines methods for identifying excessive data exposure vulnerabilities in APIs. It details how to leverage Postman and Burp Suite, popular tools for API testing, to discover instances where APIs return more sensitive or unnecessary information than required. The focus is on practical techniques for security professionals and developers to pinpoint these security flaws, enhancing API data protection. |
| 2026-11-03 NEW 2026 | Web Shell Upload via Extension Blacklist Bypass intermediate | This content details a "Web Shell Upload via Extension Blacklist Bypass" vulnerability. Instead of disguising a malicious file as a PHP script, the exploit tricks the Apache server into executing a file with a novel, unlisted extension as if it were PHP. This bypasses standard security measures that typically block known executable extensions like .php. The article suggests this method is distinct from prior, simpler bypass techniques seen in earlier examples. |
| 2026-11-02 NEW 2026 | What's new in Burp AT news 5 min read | Library updates for Burp AT introduce sending requests/responses from various Burp tools to tasks, custom skill creation for reusable testing techniques, manual skill execution, goal-setting for complex tasks with goal loops, automatic selection of the newest compatible skill versions, updated goal text limits, suggested prompts for new tasks, identification of skill sources, improved resource picking, task status indicators, clearer stopping behavior for goal loops, indefinite approval request durations, structured tool results display, file attachments to tasks, adjustable reasoning effort, prompt queuing, session-based approvals, and redirecting proposed tool actions. → portswigger.net |
| 2026-11-02 NEW 2026 | PHP2Shell x Burp Suite: detection within a day of disclosure news 3 min read RCE | Library updates for Burp Suite enable detection of PHP2Shell (CVE-2026-109618, CVE-2026-109619) shortly after its disclosure. Enhancements include passive detection via extensibility APIs, Java-based custom scan checks, and updates to the ActiveScan++ extension. Active detection payloads were developed with caution to avoid server crashes and are now integrated into Burp Scanner. Additionally, Burp AT now features a dedicated skill for PHP2Shell, and active detection is natively supported in Burp Suite DAST. → portswigger.net |
| 2026-11-02 NEW 2026 | Burp Suite Professional / Community 2026.10 release news 1 min read | Library update: Burp Suite Professional/Community 2026.10 reintroduces HTTP Digest authentication support, enhancing testing for applications employing this method. It also features improved notifications that persist across main windows, bug fixes including correct documentation link behavior and resolution of Inspector hangs on Linux, and preserves extension settings during updates. The release further includes correct SSE response handling, retained WebSocket Repeater data upon project repair, and the ability to cancel streaming requests in Repeater. Burp's browser is upgraded to Chromium 154.0.8037.98/97. → portswigger.net |
| 2026-11-01 NEW 2026 | Cara Mengatasi Eror Jaringan Kali Linux & Burp Suite saat Pertama Kali Setup (Panduan… beginner Bug Bounty | This article provides practical troubleshooting guidance for new web penetration testers and bug bounty hunters encountering network errors when setting up Kali Linux and Burp Suite. It focuses on resolving common issues during the initial setup process to ensure a smooth start in their security testing journey. |
| 2026-11-01 NEW 2026 | PortSwigger Lab: Exploiting XXE Using External Entities to Retrieve Files intermediate 1 min read XXE | Writeup detailing an XXE vulnerability exploitation in a PortSwigger lab. The technique involves intercepting a POST request with `application/xml` content type, using Burp Suite's Repeater, and defining an external entity in the XML payload to read the `/etc/passwd` file. By replacing the `productId` parameter with the defined entity `&xxe;`, the server's response revealed the contents of the local file, confirming the XXE vulnerability. |
| 2026-11-01 NEW 2026 | PortSwigger: User ID controlled by request parameter, unpredictable IDs intermediate 5 min read AuthZ IDOR | Walkthrough of broken access control where an authenticated user retrieves another user's private account information by exploiting a user-controlled request parameter. The lab demonstrates how inspecting Burp Suite traffic revealed an `id` parameter, and discovering an attacker-controlled GUID from a blog author link allowed modification of this parameter to access a different user's account and API key, illustrating the critical need for server-side authorization beyond just authentication. |
| 2026-10-31 NEW 2026 | Pentesting/Bug Bounty d’une Application Mobile : Analyse dynamique. intermediate Bug Bounty Mobile | This document outlines the process of performing dynamic analysis for mobile application pentesting and bug bounty hunting. Dynamic analysis involves observing an application's behavior while it's running to identify vulnerabilities. The content focuses on techniques and methodologies for this type of security assessment in a mobile context. No specific bounty payout amounts are mentioned in the provided text. |
| 2026-10-31 NEW 2026 | PortSwigger | API Testing Lab beginner | The PortSwigger API Testing Lab provides a hands-on environment for learning and practicing API security testing. It offers various interactive labs designed to expose common API vulnerabilities and demonstrate effective exploitation techniques. The labs cover a range of API technologies and security flaws, allowing users to develop practical skills in identifying and mitigating risks within API implementations. |
| 2026-10-31 NEW 2026 | Web Shell Upload via Path Traversal intermediate | This content describes a web security vulnerability where an attacker can exploit a path traversal flaw to upload a web shell. This allows them to execute arbitrary code on the server, gaining control over the compromised system. The summary focuses on the exploit mechanism (path traversal) and its consequence (web shell upload and remote code execution). No specific payout amount is mentioned. |
| 2026-10-31 NEW 2026 | Lab2: Host header authentication bypass — HTTP Host header attacks intermediate AuthN | This content describes a cybersecurity lab focused on HTTP Host header attacks. The primary vulnerability explored is host header authentication bypass, where attackers manipulate the Host header to trick a web application into granting unauthorized access. This technique can be used to exploit flaws in how applications validate or route requests based on the provided Host header, potentially leading to various security breaches. |
| 2026-10-31 NEW 2026 | Exploiting Blind XXE to Exfiltrate Data via a Malicious External DTD intermediate 4 min read XXE | Technique for blind XXE exfiltration using a malicious external DTD. This method leverages Burp Collaborator and an exploit server to read arbitrary files, such as `/etc/hostname` or `/etc/passwd`, and exfiltrate their contents via DNS or HTTP requests, bypassing egress filters. The technique involves defining parameter entities to read the file, construct an exfiltration URL, and then referencing these entities within an external DTD loaded by the vulnerable XML parser. Remediation focuses on disabling DTDs or external entity fetching in XML parsers, exemplified by Java's `DocumentBuilderFactory`. |
| 2026-10-31 NEW 2026 | Exploiting XXE to Perform SSRF intermediate 4 min read SSRF XXE | Technique for exploiting XML External Entity (XXE) vulnerabilities to perform Server-Side Request Forgery (SSRF). This involves configuring an XML parser to fetch URLs instead of local files, enabling requests to internal services like the AWS instance metadata service (IMDS) at `http://169.254.169.254/`. By walking the metadata tree, attackers can retrieve temporary IAM credentials, allowing them to impersonate the cloud instance and gain broad access. Remediation includes disabling DTDs and external entities in parsers, and implementing defense-in-depth measures for IMDS access. |
| 2026-09-24 2026 | HTTP/3 in Burp Suite - it’s time to find a bigger wordlist intermediate 4 min read | Library for fuzzing and exploiting HTTP/3 applications, extending Burp Suite with an HTTP/3 Adapter and enhancing Turbo Intruder. This toolkit enables speeds exceeding 100,000 requests per second, supports HTTP/3 exclusive race condition techniques like Single Datagram Attack and Server-Side Race Orchestration, and allows targeting previously hidden attack surfaces by converting traffic. It features an AUTO engine for dynamic tuning and supports kettled request syntax with pseudo header overrides. → portswigger.net |
| 2026-08-25 2026 | PortSwigger introduces Burp AT for agentic AI security testing news 3 min read | Library introducing agentic AI for professional penetration testing. Burp AT, a new Burp Suite addition, allows AI agents to perform investigative tasks using existing Burp tools and project context, with testers retaining control over scope, judgment, and validation. Agents can hypothesize, act through tools, interpret responses, and decide next steps, leveraging purpose-built pentesting skills and enforced boundaries separate from the AI model. → helpnetsecurity.com |
| 2026-08-17 2026 | Introducing Session Switcher. Swap Burp Sessions with One Click! beginner 4 min read AuthZ IDOR | Library for Burp Suite that streamlines authorization testing by enabling one-click saving and switching of HTTP sessions. Session Switcher allows users to store named sessions, including cookies and headers, directly within the request editor. It features automatic session updates based on defined rules, mirroring browser traffic to keep stored sessions valid and reducing manual effort when dealing with multiple user roles, privilege escalation, or IDOR vulnerabilities. → blog.doyensec.com |
| 2026-08-01 2026 | Intigriti Bug Bytes #238 - July 2026 🚀 news 10 min read Bug Bounty RCE Secrets | Library of articles discussing AI security threats including RAG poisoning and LLM blind spots, alongside research on the "between-reports problem" and exposure management. It also highlights recent developments like RCE in GitHub.com, hacking Gemini Enterprise, and new payout badges for researchers on the Intigriti platform. The collection features insights on bypassing Content Security Policy, exploiting insecure cookie policies, and utilizing tools like P4RS3LT0NGV3 for LLM red teaming. → intigriti.com |
| 2026-06-25 2026 | I Wasted 3 Days Intercepting a Flutter App. Here’s What Actually Works. intermediate Mobile | The author spent three days attempting to intercept traffic from a Flutter app for security assessment using various tools and techniques like Burp Suite, Objection, ReFlutter, custom CA installation, VPN interception, and Frida scripts. Despite these efforts, all methods resulted in the app displaying a "no internet" error, rather than typical SSL or certificate warnings. The author found that none of the common approaches were successful in capturing the app's traffic. → infosecwriteups.com |
| 2026-06-12 2026 | How I Built a Burp Extension Efficiently with Claude intermediate AI | Claude significantly streamlined Burp extension development for security researchers. The author used Claude to create an extension that flags non-standard HTTP headers, aiding in the discovery of injection vulnerabilities. By prompting Claude, the author generated an idea and a prototype, demonstrating how AI can overcome the coding hurdles previously associated with extension building. The extension leverages the IANA registry of common HTTP headers as a filtering mechanism. → infosecwriteups.com |
| 2026-06-10 2026 | I Found the Entire Admin UI of a Live PlatformJust By Tweaking Traffic in Burp Suite intermediate AuthZ | During an internship, Hamza Hashim (refang) discovered a significant security vulnerability on the REDACTED.org internship program portal. By manipulating traffic using Burp Suite, he gained access to the entire administrative user interface of the live platform. This article details one of the findings from his broader bug report submitted to the organization. → infosecwriteups.com |
| 2026-06-08 2026 | Introducing HTTP Anomaly Rank beginner 2 min read | Algorithm for ranking HTTP responses, HTTP Anomaly Rank, automatically identifies anomalous findings within massive result sets by calculating a score for each response based on the uniqueness of its attribute values and their stability. This technique, evolved from 2016 research for the Backslash Powered Scanner, is now integrated into Turbo Intruder and Burp Suite API (release 2025.10) to streamline vulnerability discovery by highlighting subtle discrepancies in noisy responses. → portswigger.net |
| 2026-05-26 2026 | 7 Best Penetration Testing Tools & Software beginner 12 min read | Toolset summarizing Cobalt Strike, Core Impact, Burp Suite, and Metasploit for penetration testing. Cobalt Strike facilitates threat emulation and post-exploitation, while Core Impact simulates real-world attacks with network, client-side, and web application testing. Burp Suite offers a comprehensive suite for vulnerability discovery and exploitation, featuring traffic interception and extensive customization via BApps. Metasploit provides a framework for exploiting vulnerabilities, emulating compromised machines, and includes post-exploitation tools. → esecurityplanet.com |
| 2026-05-03 2026 | GitHub - SharonBrizinov/Holy-Grail-PCAP: "Holy Grail PCAP" is a capture file offering exceptional coverage across nearly all tcpdump/Wireshark encapsulation types and dissectors. beginner 8 min read | Library for comprehensive Wireshark dissector code coverage analysis and bug hunting, featuring the "Holy Grail PCAP," a meticulously crafted capture file. This library includes over 1,600 dissectors across 186 link-layer types, including Bluetooth, USB, and CAN bus. It utilizes tools like `wirecov` for coverage measurement and `wirefuzz` for targeted dissector fuzzing, enabling bug discovery, CI/CD regression testing, and stress testing of packet processing tools. |
| 2026-04-26 2026 | Burp Suite Automation: 12 Custom Extensions That Save Hours for Pentesters and Bug Hunters intermediate | This article highlights 12 custom Burp Suite extensions designed to automate tedious tasks for penetration testers and bug hunters. These tools aim to save significant time by automating processes like input fuzzing and XSS detection, preventing missed vulnerabilities due to manual oversight. The focus is on efficiency and improving the effectiveness of security testing workflows. No specific payout amounts were mentioned in the provided text. |
| 2026-04-22 2026 | SulphurAPI: Burp Suite extension for automating OWASP API Top 10 detection intermediate | Extension for automating OWASP API Top 10 detection within Burp Suite. SulphurAPI includes checks for mass assignment, authentication, and authorization vulnerabilities, alongside OpenID Connect/OAuth2 management and advanced OpenAPI parsing for versions 2.0 to 3.1.1. |
| 2026-04-22 2026 | Awesome Burp Extensions 2025 intermediate 48 min read | Library of curated Burp extensions for enhancing web application penetration testing. Features include scanners for vulnerabilities like Log4Shell (CVE-2021-44228), HTTP Request Smuggling, and Java deserialization. Additional extensions aid in discovering Content Security Policy (CSP) bypasses, identifying software versions, detecting reverse proxies, and testing for Cloudflare origin IPs, among many other specialized checks and integrations. |
| 2026-04-22 2026 | Top 10 Web Hacking Techniques of 2025: Call for Nominations news 12 min read | Survey of 2025 web hacking techniques, including nominations for novel practical research. Highlighted techniques involve JNDI Injection, Exploiting XXE with Local DTD Files, Eclipse on Next.js, Next.js cache poisoning, Go parser bypasses, HTTP/1.1 desync, Chromium DOM clobbering, cross-protocol desynchronization (Opossum Attack), SAML authentication bypasses, ambiguous chunk terminators for request smuggling, Cross-Site WebSocket Hijacking, SVG filter clickjacking, nonce CSP bypass, SSRF via redirect loops, Unicode normalization exploits, SOAP proxy RCE, PHP warnings for quirks mode, ORM field smuggling, parser differentials, and DOM-based extension clickjacking. → portswigger.net |
| 2026-04-22 2026 | The Future of Security Testing: AI-Powered Extensibility in Burp advanced 3 min read | Library for AI-powered extensibility in Burp Suite Professional, leveraging the Montoya API to integrate AI capabilities for enhanced security testing and automation. This allows for seamless integration of AI, exemplified by Gareth Heyes' enhanced Hackvertor extension, which enables custom transformations without coding. Users receive free AI credits to experiment and build their own AI-powered extensions, with options to submit them to the BApp store. → portswigger.net |
| 2026-04-22 2026 | Filtering the WebSockets history with scripts intermediate 3 min read | Library for filtering WebSockets history in Burp Suite, allowing users to create and load custom Java-based scripts. Users can write new scripts from templates, convert existing filter settings into scripts, or import scripts from their Bambda library. The library supports two key Montoya API objects, `ProxyWebSocketMessage` and `Utilities`, to facilitate script development for analyzing and filtering WebSocket traffic based on criteria like message direction and payload length. → portswigger.net |
| 2026-04-22 2026 | Filtering the HTTP history with scripts (Bambdas) intermediate 4 min read | Library for creating custom Java-based scripts, known as Bambdas, to filter Burp Suite's HTTP history. Users can load pre-existing scripts from their library or create new ones using built-in templates or by converting existing filter settings. The library leverages the Montoya API and provides a GitHub repository for community contributions and examples, enabling advanced traffic analysis based on criteria like response status codes and cookie presence. → portswigger.net |
| 2026-04-22 2026 | Developing AI features in Burp extensions advanced 7 min read | Library for integrating AI capabilities into Burp Suite extensions via the Montoya API. This resource details how extensions must declare AI feature support using `EnhancedCapability.AI_FEATURES` and verify availability with `Ai.isEnabled()`. It explains sending single-shot and multi-turn prompts using `Message` objects for system, user, and assistant roles, and handling responses through `PromptResponse`. → portswigger.net |
| 2026-04-22 2026 | Burp AI - PortSwigger Documentation beginner 3 min read | Library integrating AI capabilities into Burp Suite for enhanced security testing. Features include AI in Repeater for custom prompts, Explore Issue for autonomous vulnerability investigation, and Explainer for understanding web technologies. It also offers AI-powered false positive reduction for Broken Access Control, automated recorded logins, and extensible AI features via the Montoya API, all while prioritizing user control, data privacy, and industry-standard security. → portswigger.net |
| 2026-04-22 2026 | Bambdas - PortSwigger Documentation beginner 2 min read | Library for scripting Burp Suite's interface to personalize tasks. Bambdas allow for custom match-and-replace rules, table columns, filters, and scan checks. Scripts can be saved, imported from sources like the Bambdas GitHub repository, and reused across projects. PortSwigger warns that Bambda scripts can execute arbitrary code, advising caution with unverified sources. → portswigger.net |
| 2026-04-19 2026 | Pentest-Mapper: Burp Extension for Pentesters & Bug Bounty intermediate 2 min read | Library for Burp Suite that maps application testing flows with custom checklists. Pentest-Mapper logs API calls, allowing users to connect them to specific vulnerabilities from a loaded checklist. It also tracks test cases, enables vulnerability mapping with severity, and offers auto-save, import/export functionality, and auto-logging of scoped APIs. |
| 2026-04-19 2026 | Burp Suite Extension: Copy For — Black Hills InfoSec intermediate 3 min read | Library for Burp Suite that generates command-line syntax for security tools like `curl`, `ffuf`, `jwt_tool.py`, `Nikto`, `Nmap`, `Nuclei`, and `wget` directly from requests. It supports variable substitution and configurable flags, allowing users to create custom commands. |
| 2026-04-19 2026 | Burp AI — PortSwigger intermediate | Burp AI — PortSwigger → portswigger.net |
| 2026-04-19 2026 | Pentest Mapper: Burp Extension for Application Pentesting intermediate 2 min read | Extension for Burp Suite that integrates request logging with a custom application testing checklist. It enables users to map application flows and API calls, link them to vulnerabilities from a customizable checklist, and track parameters and severity. Features include auto-saving, import/export functionality, and the ability to map individual requests to vulnerabilities with optional CVSS scoring. |
| 2026-04-19 2026 | Pentest Mapper — PortSwigger BApp Store intermediate | Library for mapping application flows during penetration testing. Pentest Mapper integrates Burp Suite request logging with a custom checklist, allowing testers to connect API calls to specific functions and map identified vulnerabilities. This Burp Suite extension facilitates a structured approach to application analysis and vulnerability assessment. → portswigger.net |
| 2026-04-16 2026 | Burp Suite Professional Testing Handbook beginner 3 min read | Library for Burp Suite Professional, an HTTP interception proxy with features for web application security testing. It aids in identifying server-side and client-side vulnerabilities by intercepting and manipulating requests/responses, fuzzing payloads with Intruder, and analyzing traffic with Proxy and Scanner. The handbook also mentions Burp's DOM Invader extension and Trail of Bits webinars on mastering web research with Burp Suite. → appsec.guide |
| 2026-04-16 2026 | Bambdas Collection for Burp Suite Professional and Community intermediate 3 min read | Library of Bambdas for Burp Suite, offering scripts for table filters, custom columns, Repeater actions, match and replace rules, and custom scan checks. Developed by PortSwigger and the community, these scripts enhance Burp Suite's functionality, with Java-based checks available in this repository and BChecks in a separate repo. Instructions cover importing, updating, and contributing scripts, with security warnings about executing arbitrary code. Resources include detailed documentation and video tutorials on various Bambda functionalities. |
| 2026-04-16 2026 | Turbo Intruder: Embracing the Billion-Request Attack advanced 8 min read | Library for high-speed, scalable web application attacks. Turbo Intruder is a Burp Suite extension built from scratch with a custom HTTP stack, outperforming many asynchronous scripts. It supports flexible Python-based attack configuration for complex needs like signed requests, handles malformed requests, and filters results with an advanced diffing algorithm. It can achieve millions of requests with flat memory usage, and offers command-line operation for optimized performance by co-locating with targets. → portswigger.net |
| 2026-04-16 2026 | BurpSuite for Pentester - Vulnerability Hunting Cheatsheet beginner | Library for penetration testers and bug bounty hunters, this practical Burp Suite cheat sheet aids in efficiently discovering web application vulnerabilities from P4 to P1. It offers a structured reference for web application security testing, guiding users on leveraging Burp Suite's features for traffic interception, request analysis, parameter fuzzing, and identifying vulnerabilities in modern web applications. |
| 2026-04-16 2026 | Weaponize Your Burp - Bug Bounty Hunting Automation intermediate | Library for automating Burp Suite for bug bounty hunting. This project weaponizes Burp Suite with extensions like Burp Bounty Pro, Logger++, and AutoRepeater. It details a methodology for integrating custom payloads into AutoRepeater and using Logger++ filters to identify potential vulnerabilities, then sending suspicious requests to Repeater for exploitation. Examples demonstrate configuring custom payloads to enhance bug hunting capabilities. |
| 2026-04-16 2026 | Smart Automation with Burp Suite - YesWeHack intermediate 5 min read | Library for automating Burp Suite workflows, this resource details using passive scanners like the built-in passive scanner and passive crawler, alongside extensions such as BChecks, Burp Bounty, and Logger++, to streamline bug bounty efforts. It explains how to combine active and passive scanning to efficiently gather information and discover vulnerabilities, emphasizing the importance of custom headers for tracking BCheck requests and leveraging error messages for deeper analysis, while still advocating for manual testing to complement automated findings. → yeswehack.com |
| 2026-04-16 2026 | A Guide to Build Burp Suite Extensions Using Montoya API and Java intermediate | A Guide to Build Burp Suite Extensions Using Montoya API and Java |
| 2026-04-16 2026 | Power Up Pen Tests: Create Burp Suite Extensions with Montoya API intermediate 15 min read | Library for developing Burp Suite extensions using the Montoya API, streamlining tasks like authentication handling, API data mining, and UI visualization. This API, introduced in Burp Suite 2022.9.5, offers improved object-oriented design, WebSocket support, and simplified HTTP message manipulation compared to the older extender API, enabling developers to create more robust and flexible tools like the example "BurpCage" extension that replaces images with Nicolas Cage photos. → bishopfox.com |
| 2026-04-16 2026 | Burp Suite Extensions - Overview and Introduction with Kotlin beginner 6 min read | Library for developing Burp Suite extensions, focusing on the modern MontoyaApi with Kotlin. This resource details how to create powerful extensions, introducing concepts like Bambdas for filtering and BChecks for custom scan checks. It showcases the development of the HeaderMate extension, which automates server response header evaluation against OWASP recommendations and configurable rules, offering features like selective host checking, issue creation toggling, and CSV export. |
| 2026-04-16 2026 | Creating Burp Extensions: A Beginner's Guide - Black Hills InfoSec beginner 48 min read | Library for creating Burp Suite extensions. This resource guides beginners through developing custom functionalities for Burp Suite, a web application proxy essential for security testing. It explains what Burp extensions are, why they enhance testing capabilities, and covers the necessary tools and languages for development. The presentation introduces the Montoya API for integration and showcases a practical example of a JWT editor extension, illustrating how these additions expand Burp Suite's utility beyond its default features. |
| 2026-04-10 2026 | Burp Suite Certified Practitioner Guide 2026 beginner 10 min read | Guide to the Burp Suite Certified Practitioner (BSCP) exam, PortSwigger’s hands-on web application security certification. This resource details the exam format, including its remote, proctored, timed structure with two live applications, and the three sequential stages required per application. It emphasizes demonstrating exploit impact, using Burp Suite Professional and allowed third-party tools like ysoserial, and mastering techniques such as XSS exploitation, SQL injection, and SSRF. The guide offers preparation strategies, including PortSwigger’s official prep path, practice exams, and sample 30, 60, and 90-day study plans, to help candidates achieve certification. |
| Browse all 195 Burp Suite resources → | ||
Frequently Asked Questions
- What is Burp Suite used for?
- Burp Suite is a web application security testing platform. It intercepts HTTP/HTTPS traffic between your browser and target application, allowing you to inspect, modify, and replay requests. Key tools include Proxy (traffic interception), Repeater (manual request testing), Intruder (automated fuzzing), and Scanner (automated vulnerability detection).
- What is the difference between Burp Suite Community and Pro?
- Burp Suite Community Edition provides the core proxy, repeater, and decoder tools for free. The Professional edition adds the automated vulnerability scanner, Intruder with full speed (Community is throttled), the Collaborator client for out-of-band testing, project saving, and content discovery features.
- What are the most useful Burp Suite extensions?
- Essential extensions include Autorize (authorization testing), Active Scan++ (enhanced scanning), Logger++ (advanced logging), Param Miner (hidden parameter discovery), Turbo Intruder (high-speed fuzzing with Python), and Hackvertor (encoding/decoding). The BApp Store contains hundreds of community extensions.
Weekly AppSec Digest
Get new resources delivered every Monday.