The newest Burp Suite resources are on the Burp Suite page. For a reading order instead of a date order, see the Burp Suite learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-01-29 2026 | How I Made Burp Suite My IDOR-Finding Robot Butler (And Found 20+ Bugs) ๐ค๐ intermediate Bug Bounty IDOR | The content titled "How I Made Burp Suite My IDOR-Finding Robot Butler (And Found 20+ Bugs)" likely discusses utilizing the Burp Suite tool to automate the discovery of Insecure Direct Object Reference (IDOR) vulnerabilities, leading to the identification of over 20 bugs. The author shares their experience and strategies for leveraging Burp Suite effectively in bug hunting. The content may provide insights into the process of using automation tools for security testing and the successful outcomes achieved through this approach. โ infosecwriteups.com |
| 2026-01-24 2026 | Burp Suite | Pentest Book beginner | Burp Suite | Pentest Book |
| 2026-01-20 2026 | MantisSTS/JSReconduit: Passive JavaScript reconnaissance for penetration testers โ bridging Burp Suite traffic into structured, AST-based analysis in VSCode. intermediate 5 min read Recon | Library bridging Burp Suite traffic into VSCode for passive JavaScript reconnaissance. It captures JavaScript assets via a Burp Suite extension and performs Abstract Syntax Tree (AST) analysis within VSCode, rendering findings like API endpoints, routes, drift detection, clusters, dataflow traces, and secrets. The tool supports source-to-sink tracing, lazy chunk extraction, optional deobfuscation, and various export formats including JSON, CSV, and SARIF. Custom signature packs can be integrated for enhanced detection. |
| 2026-01-17 2026 | pwviptbl/ProxyHunter: Aplicaรงรฃo Python com interface grรกfica que permite configurar regras de interceptaรงรฃo para modificar parรขmetros de requisiรงรตes HTTP. Quando o navegador envia uma requisiรงรฃo para uma rota configurada, o proxy intercepta, modifica apenas os parรขmetros especificados e encaminha a requisiรงรฃo mantendo todos os outros parรขmetros originais. intermediate 12 min read API Sec Python | Library for intercepting and modifying HTTP request parameters, featuring a GUI built with PySide6. It supports rule-based interception for GET and POST requests, manual interception with forward/drop capabilities inspired by Burp Suite, and WebSocket support. Additional modules include an advanced Intruder for automated attacks, a vulnerability scanner detecting SQL injection, XSS, CSRF, Path Traversal, and exposed sensitive information, a spider for site discovery, a request comparator, and a command-line interface for headless operation. |
| 2026-01-16 2026 | Included Skills: ๐๐ฎ๐ซ๐ฉ๐ฌ๐ฎ๐ข๐ญ๐-๐ฉ๐ซ๐จ๐ฃ๐๐๐ญ-๐ฉ๐๐ซ๐ฌ๐๐ซ - Search/extract data from Burp Suite projects ๐๐ข๐๐๐๐ซ๐๐ง๐ญ๐ข๐๐ฅ-๐ซ๐๐ฏ๐ข๐๐ฐ - Security-focused differential review of code changes intermediate | The content discusses two included skills: searching/extracting data from Burp Suite projects and conducting a security-focused differential review of code changes. These skills are valuable for individuals involved in cybersecurity or software development. The link provided likely offers more detailed information on these skills. |
| 2026-01-02 2026 | repplus/rep: rep+ โ Burp-style HTTP Repeater for Chrome DevTools with builtโin AI to explain requests and suggest attacks intermediate 7 min read | Library: rep+ is a Chrome DevTools extension mimicking Burp's Repeater, enhanced with AI. It captures and replays HTTP requests without proxy setup, offering features like multi-tab capture, hierarchical grouping, and robust filtering. Built-in AI can explain requests, suggest attack vectors, and modify requests directly. It supports detailed secret and endpoint extraction, parameter risk assessment, and generates Postman collections. rep+ integrates with Claude, Gemini, and Ollama, featuring a chat interface for contextual analysis across multiple requests, and offers extensive theming options. |
| 2025-12-30 2025 | Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage. intermediate 38 min read API Sec Fuzzing GraphQL | Library for comprehensive API security testing within Burp Suite. It consolidates 15 attack types, including BOLA, IDOR, SQLi, and GraphQL specific vulnerabilities, leveraging over 108 payloads and intelligent fuzzing. Features include automated reconnaissance, smart normalization of API endpoints, AI integration for payload generation, and seamless integration with external tools like Nuclei, Turbo Intruder, HTTPX, and SQLMap. It covers the OWASP API Top 10 and offers differential-first logic coverage and token lifecycle drift analysis. |
| 2025-12-10 2025 | Web App Hacking: Finding Web App Vulnerabilities with Caido Scanner news | Caido just became a serious Burp killer. Scanner plugin auto-detects vulns as you browse + launches targeted attacks on suspicious endpoints: https://t.co/wkiXeRK5CU |
| 2025-12-03 2025 | Web App Hacking: Finding Web App Vulnerabilities with Caido Scanner news | Caido just became a serious Burp killer. Scanner plugin auto-detects vulns as you browse + launches targeted attacks on suspicious endpoints: https://t.co/GqmmOXsL75 @three_cube |
| 2025-08-14 2025 | d0ge/sign-saboteur: SignSaboteur is a Burp Suite extension for editing, sig intermediate 4 min read | Library for editing, signing, verifying, and attacking signed tokens within Burp Suite. It supports numerous token types including Django, ItsDangerous, Express, OAuth2 Proxy, Tornado, Ruby Rails, Nimbus JOSE + JWT, and unknown signed strings. Features include automatic detection and in-line editing, signing, and brute-force attacks against signed token implementations, with modes for known keys, fast, balanced, and deep attacks, alongside authorization attacks like user claims and wrapped user claims. |
| 2025-08-14 2025 | 254Labs/awesome-bambdas: A collection of Burp Suite Lambda Filters ~ Bambda intermediate 1 min read | Library of Bambdas (Burp Suite's Lambdas) that customize Burp Suite's workflow. This collection, housed in the 254Labs/awesome-bambdas GitHub repository, categorizes filters by request or response object methods. Users can switch to Bambda mode in the HTTP Proxy history's "Configure filter" menu, then copy or download a bambda to the editor. Contributions are welcomed via pull requests. |
| 2025-08-14 2025 | Burp Extension Dev Part 4: GUI Design - TCM Security intermediate 4 min read | Library for developing Burp Suite extensions, focusing on GUI design. This resource details how to create user interfaces for custom tools within Burp Suite, enabling security professionals to build more effective and integrated application security testing workflows. |
| 2025-08-14 2025 | GitHub - federicodotta/Burp-Suite-Extender-Montoya-Course: This repository beginner | Library containing Burp Suite extension examples built with the Montoya API. This resource offers practical code for creating plugins that inspect and modify HTTP/WebSocket traffic, add custom context menu items, and integrate active/passive scanner checks, including BChecks and custom scan checks. It covers environment setup, basic extension development, and advanced features like Collaborator integration. |
| 2025-08-14 2025 | GitHub - dwisiswant0/ngocok: ngrok Collaborator Link โ yet another Burp Col intermediate 1 min read | Library for intercepting out-of-band requests, serving as an alternative to Burp Collaborator by leveraging ngrok. It allows users to establish ngrok tunnels for capturing HTTP or TCP requests, with authentication managed via an authtoken flag, NGROK_AUTHTOKEN environment variable, or the ngrok configuration file. Ngocok can also log incoming requests to a specified file. |
| 2025-08-14 2025 | Burp Extension Dev Part 1: Setup & Basics - TCM Security beginner 4 min read | Library for developing Burp extensions, this guide focuses on setup and basic functionalities, aiming to equip users with practical skills for uncovering vulnerabilities like injection flaws and broken access controls within web applications, ultimately strengthening security posture. |
| 2025-08-14 2025 | Writing Burp Bambda Filters Like a Boss intermediate 7 min read | Library for creating custom Burp Suite Proxy HTTP history filters using Java snippets. This feature, named "Bambdas," allows for advanced filtering beyond standard options, such as identifying specific JWT algorithms like HS512 within Authorization headers. Users can write and save these filters via the UI, leveraging interfaces like `ProxyHttpRequestResponse` and `Utilities` for complex request analysis. โ danaepp.com |
| 2025-08-14 2025 | synfron/ReshaperForBurp intermediate 3 min read | Extension for Burp Suite that allows triggering actions and reshaping HTTP request/response and WebSocket traffic via configurable Rules. These Rules process messages based on criteria like content type, event direction, source tool, scope, and text matches, executing actions such as building HTTP messages, dropping connections, extracting values, logging, prompting, running scripts, saving files, and setting variables. It supports sharing values across rules and can be built and run within IntelliJ for debugging. |
| 2025-08-14 2025 | Improve your API Security Testing with Burp BCheck Scripts intermediate 9 min read | Library for Burp Suite Professional that enables API security testing automation through BCheck scripts. These scripts, written in BSL, allow automated requests, response validation, Collaborator interaction, and programmatic payload injection. The library simplifies creating custom checks, like detecting missing Authorization headers (CWE-864), by integrating with Burp's scanner engine, thus accelerating manual testing workflows and improving efficiency. โ danaepp.com |
| 2025-08-14 2025 | DNS Analyzer - Finding DNS vulnerabilities with Burp Suite - SEC Consult intermediate 7 min read | Burp extension for discovering DNS vulnerabilities in web applications, leveraging Burp Collaborator to analyze DNS name resolution. The tool helps identify predictable UDP source ports and DNS IDs, key indicators for Kaminsky-style DNS cache poisoning attacks. Users generate a unique collaborator domain, trigger DNS resolutions (e.g., via user registration or password reset), and analyze interaction data through scatter plots and statistical metrics like standard deviation and direction bias to assess the predictability of DNS query parameters. |
| 2025-08-14 2025 | Burp Suite: The Basics TryHackMe Writeup beginner | The content is about a writeup on using Burp Suite for basic tasks on TryHackMe. Burp Suite is a popular web application testing tool used for security assessments. The writeup likely covers introductory information, tutorials, and practical exercises related to using Burp Suite in a simulated hacking environment provided by TryHackMe. This content is likely to provide insights into how to use Burp Suite effectively for testing and securing web applications. |
| 2025-08-14 2025 | lucsemassa/burp_bug_finder: Automatic Bug finder with buprsuite intermediate 1 min read | Library for automated web vulnerability discovery within Burp Suite. This Python-based plugin focuses on identifying XSS and error-based SQL injection vulnerabilities. It automatically injects payloads into intercepted requests, including parameters and cookies, and analyzes responses for malicious patterns or SQL error messages. Users can configure targets via the scope and receive alerts in the Burp Suite dashboard for identified issues. Installation requires Jython. |
| 2025-08-14 2025 | Vulnerabilities detected by Burp Scanner - PortSwigger beginner | The content provided is a title mentioning vulnerabilities detected by Burp Scanner, a web vulnerability scanner developed by PortSwigger. It suggests that the focus is on identifying security weaknesses in web applications through the use of this tool. The summary lacks detailed information about specific vulnerabilities or how they are detected, but it highlights the importance of using tools like Burp Scanner to enhance the security of web applications. โ portswigger.net |
| 2025-08-14 2025 | botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study intermediate | The content appears to be a study guide or resource related to preparing for the Burp Suite Certified Practitioner Exam. It seems to be created by a user named botesjuan. The content likely includes information, tips, and resources to help individuals study and prepare for the certification exam. |
| 2025-08-14 2025 | xnl-h4ck3r/GAP-Burp-Extension intermediate 3 min read | Extension for Burp Suite that identifies additional potential parameters, links for testing, and generates target-specific wordlists for fuzzing. It enhances the original `getAllParams` extension by supporting various parameter types like XML and GraphQL, and offers modes for finding parameters, words, and improved link discovery. Installation involves setting up Jython, installing required modules via `pip`, and loading the `GAP.py` script within Burp. |
| 2025-08-14 2025 | nccgroup/AutoRepeater: Automated HTTP Request Repeating With Burp Suite intermediate 3 min read | Library for Burp Suite that automates HTTP request repeating, streamlining authorization testing. It allows researchers to duplicate, modify, and resend requests with conditional replacements for headers, cookies, and parameters. Unlike AuthMatrix, Authz, and Autorize, AutoRepeater offers general-purpose replacements and a familiar interface, facilitating testing for issues like account takeover or privilege escalation by automatically evaluating response differences. |
| 2025-08-14 2025 | My First Burp Suite Extension beginner 9 min read | Library for developing custom Burp Suite extensions in Java. This project details the creation of a simple extension that checks for specific HTTP response headers, demonstrating how to set up the development environment, implement `IBurpExtender` and `IScannerCheck` interfaces, and define custom `IScanIssue` objects for reporting findings. The code is available on GitHub. |
| 2025-08-14 2025 | The Top 8 Burp Suite Extensions - Think outside the box beginner | The content briefly mentions the top 8 Burp Suite extensions, encouraging users to think creatively and explore beyond the standard features of the tool. It suggests that by utilizing these extensions, users can enhance their security testing capabilities and discover new ways to improve their testing processes. The emphasis is on expanding one's toolkit and considering innovative approaches to maximize the benefits of using Burp Suite. |
| 2025-08-14 2025 | Open Security Research: Extending Burp Proxy With Extensions intermediate | The content discusses open security research focused on extending Burp Proxy with extensions. It likely explores the development and implementation of additional functionalities or features within Burp Proxy to enhance its capabilities for security testing and analysis. The article may delve into the benefits, methods, and potential outcomes of extending Burp Proxy through the use of extensions, aiming to provide insights and guidance for security researchers and professionals seeking to optimize their security testing tools. |
| 2025-08-14 2025 | PortSwigger Web Security Blog: Writing your first Burp Suite extension beginner 2 min read | Library for writing Burp Suite extensions, detailing the creation of both Java and Python plugins. It guides users through setting up an IDE, exporting Burp's Extender interface files, writing basic `BurpExtender` code, compiling Java JARs, and configuring Jython for Python extensions. The entry also notes potential `OutOfMemoryError` issues with Python extensions and suggests solutions. |
| 2025-08-14 2025 | Authorization Testing: AuthMatrix - Part 1 | White Oak Security intermediate 2 min read | Tool explaining Authorization Testing with AuthMatrix, focusing on practical implementation for identifying and mitigating access control vulnerabilities. This resource covers how to effectively test for authorization flaws within applications to enhance overall security posture. โ whiteoaksecurity.com |
| 2025-08-14 2025 | Web App Pentesting With Burp Suite Scan Profiles | White Oak beginner 2 min read | Guide to optimizing Burp Suite scan profiles for web application penetration testing. It details how to configure profiles to enhance efficiency and effectiveness during security assessments, ensuring comprehensive coverage of potential vulnerabilities. โ whiteoaksecurity.com |
| 2025-08-14 2025 | Some of the best Burp extensions - as chosen by you intermediate 2 min read | Extensions from the Burp Suite BApp Store are highlighted, including Autorize for testing authentication vulnerabilities, Turbo Intruder for high-speed automated attacks, Hackvertor for tag-based encoding and escaping, Burp Bounty for custom scan checks, and Param Miner for identifying hidden parameters to hunt for web cache poisoning. โ portswigger.net |
| 2025-08-14 2025 | Great getting started resources for new users of Burp Suite Professional | beginner 4 min read | Library of resources for new Burp Suite Professional users, including video tutorials on UI basics and Scanner setup, blog posts detailing exclusive features like Intruder and Collaborator client, and the free Web Security Academy with learning paths on SQL injection and other topics. Community content from creators like InsiderPhD, webpwnized, and STรK showcases practical applications, alongside the BApp Store for extensions and Extender documentation for custom development. โ portswigger.net |
| 2025-08-14 2025 | Web app pentesting burp suite scan profile intermediate 2 min read | Profile for Burp Suite web application penetration testing, detailing how to configure scans to effectively identify vulnerabilities. This profile emphasizes a security-led approach, offering comprehensive IT services, penetration testing, and risk management solutions. It guides companies from initial assessment and practical implementation to ongoing support and strategic security elevation, advising on regulatory compliance standards. โ whiteoaksecurity.com |
| 2025-08-14 2025 | Authentication Token Obtain and Replace (ATOR) Burp Plugin: Fast and Reliab intermediate | The content is about the Authentication Token Obtain and Replace (ATOR) Burp Plugin, which is described as fast and reliable. It likely focuses on a tool or extension that aids in obtaining and replacing authentication tokens within the Burp Suite software. The plugin is designed to streamline the process of managing authentication tokens, enhancing efficiency and reliability in security testing and web application assessments. |
| 2025-08-14 2025 | BurpSuite Extensions: Some Favorites - VDA Labs beginner 3 min read | Library of Burp Suite extensions offering enhanced application security testing. Features include Taborator for out-of-band interactions, beautifiers for response readability, Active Scan++ and Additional Scanner Checks for broader issue detection, Freddy for deserialization vulnerabilities, HTML5 Auditor, CSP-Bypass for header analysis, AWS Security Checks, Retire.js for outdated JavaScript, SSL Scanner for TLS assessment, J2EEScan for J2EE vulnerabilities (including CVE-2010-1871, CVE-2011-2730, and S2-016), Error Message Checks, Software Vulnerability Scanner using Vulners.com API, CSRF Scanner, Collaborator Everywhere for backend interaction discovery, and Upload Scanner for file upload bypasses. |
| 2025-08-14 2025 | Burp Share Requests - PortSwigger intermediate 1 min read | Extension for Burp Suite that generates shareable links to specific HTTP requests. Users can right-click requests in various Burp tabs and select "create link" to add them to the "Burp Share Requests" tab. From there, HTML or direct browser links can be generated for easy sharing with other Burp Suite users, streamlining collaboration and analysis of captured traffic. โ portswigger.net |
| 2025-08-14 2025 | PortSwigger Launches Web Security Academy news 2 min read | Academy providing free, interactive labs and reading materials for web security training. Developed by PortSwigger, makers of Burp Suite, it addresses the global cybersecurity talent shortage. The platform offers continuously updated content on topics like clickjacking, WebSocket, HTTP request smuggling, server-side request forgery, and XXE injection, in a safe, risk-free testing environment. Users can track progress and compete on leaderboards. โ infosecurity-magazine.com |
| 2025-08-14 2025 | Simple dirty script to fuzz a SOAP request using the BURP Sniper approach using Windows authentication. beginner | The content in the provided link discusses the importance of securing web applications against common vulnerabilities like SQL injection, cross-site scripting, and cross-site request forgery. It emphasizes the significance of implementing security measures such as input validation, output encoding, and parameterized queries to prevent these attacks. The author also highlights the significance of keeping software components updated and conducting regular security assessments to identify and address potential vulnerabilities. Overall, the content stresses the critical role of proactive security practices in safeguarding web applications from malicious exploitation. |
| 2025-08-14 2025 | snoopysecurity/awesome-burp-extensions: A curated list of amazingly awesome Burp Extensions beginner 48 min read | Library of curated Burp extensions enhancing security testing capabilities. This extensive list includes tools for passive and active scanning, such as ActiveScan++, Burp Vulners Scanner, and J2EEScan. It also features extensions for specific vulnerabilities like CSRF, HTML5 security risks, Java deserialization, and Log4Shell (CVE-2021-44228), alongside utilities for Content Security Policy bypass, HTTP request smuggling, and GraphQL security testing with InQL Scanner. Extensions are categorized for easy navigation, covering areas like Cloud Security, OAuth, Information Gathering, and Web Application Firewall Evasion. |
| 2025-08-14 2025 | Using Burp to Test a REST API | Burp Suite Support Center intermediate 2 min read | Guide to testing REST APIs using Burp Suite, demonstrating how to identify API endpoints and map the attack surface by proxying traffic and analyzing JSON or XML responses. The guide details using the Repeater tab to identify vulnerable parameters, such as those susceptible to arithmetic evaluation, and then performing SQL injection attacks by crafting specific SQL syntax to verify vulnerabilities. |
| 2025-08-14 2025 | PortSwigger/param-miner beginner 1 min read | Extension that identifies hidden, unlinked parameters, significantly aiding in the discovery of web cache poisoning vulnerabilities. Param Miner employs advanced diffing logic and a binary search technique to probe up to 65,000 parameter names per request, drawing from both a built-in wordlist and harvested terms from in-scope traffic. It integrates seamlessly with Burp Suite, reporting findings as scanner issues in Pro versions or listing them under the Extender tab, and supports scalable multi-request attacks and auto-mining of traffic. |
| 2025-08-14 2025 | GitHub - nccgroup/BurpSuiteHTTPSmuggler: A Burp Suite extension to help pen intermediate | Extension for Burp Suite designed to assist pentesters in bypassing Web Application Firewalls (WAFs) or assessing their efficacy through various HTTP request encoding techniques. Developed by NCC Group, its initial release (v0.1) focuses on the complex task of encoding, with future versions planned to incorporate additional bypass methods. |
| 2025-08-14 2025 | The Top 5 Burp Suite Extensions beginner 3 min read | Library of Burp Suite extensions enhancing penetration testing capabilities. This collection highlights tools like XSS Validator for accurate vulnerability identification, Burp Notes for organized documentation, Sentinel as a free alternative scanner, Random IP Address Header to bypass WAFs, and Bupy/Python Scripter for custom script development, ultimately boosting researcher productivity and profitability. |
| 2025-08-14 2025 | Burp Suite for Pentester: HackBar intermediate 9 min read XSS XXE | Library for Burp Suite, HackBar streamlines manual penetration testing by providing pre-defined payloads for common vulnerabilities like SQL Injection, Cross-Site Scripting, and Local File Inclusion. This Java-based plugin, installed via its GitHub repository, offers dropdown lists of exploit dictionaries, significantly speeding up the process of testing injection points and identifying exploitable flaws within applications. |
| 2025-04-30 2025 | #burp #pentest #ai #hackerassociate #cybersecurity #infosecโฆ | Harshad Shah intermediate AI Talks | Setting Up #Burp MCP Server on Claude Desktop #Pentest Modern App with #Ai โข Learn how to set up a ๐๐๐ฟ๐ฝ ๐ ๐๐ฃ ๐ฆ๐ฒ๐ฟ๐๐ฒ๐ฟ on your ๐๐น๐ฎ๐๐ฑ๐ฒ ๐ฑ๐ฒ๐๐ธ๐๐ผ๐ฝ in this easy-to-follow tutorial. โข Get your server up and... |
| 2025-04-10 2025 | Best Browser Extensions for Bug Hunting and Cybersecurity beginner Bug Bounty | If you are getting into bug hunting or cybersecurity the right tools can make a huge difference. Browser extensions help automate tasks, find hidden vulnerabilities and protect your privacy. Here isโฆ โ infosecwriteups.com |
| 2025-04-03 2025 | Sticky Burp, Reusable and Replaceable Environment Variables intermediate 2 min read | Library for managing reusable environment variables ("stickies") within Burp Suite. This tool allows users to capture selected text from request and response panes across various Burp tabs, such as Proxy and Repeater. Stickies are stored with names, values, source information, and notes, enabling quick replacement of payload content with these stored variables, useful for exploit server URLs, authentication tokens, or dynamic response data. Professional editions persist stickies across Burp projects. โ portswigger.net |
| 2025-03-10 2025 | GitHub - vsec7/BurpSuite-Xkeys: A Burp Suite Extension to extract interesting strings (key, secret, token, or etc.) from a webpage. intermediate Secrets | Extension for Burp Suite that passively scans webpages to extract sensitive strings like keys, secrets, and tokens. It lists these findings as information issues within Burp's issues box and output extender, aiding in the identification of potential security vulnerabilities by highlighting credential leakage. |
| 2025-03-08 2025 | GitHub - trufflesecurity/trufflehog-burp-suite-extension: Official TruffleHog Burp Suite Extension. Scan Burp Suite traffic for 800+ different types of secrets (API keys, passwords, SSH keys, etc) using TruffleHog. intermediate 2 min read Secrets | Extension for Burp Suite that leverages TruffleHog to scan traffic for over 800 types of secrets, including API keys, passwords, and SSH keys. The extension writes HTTP traffic to disk, which TruffleHog then scans every 10 seconds, reporting any found secrets in a dedicated tab. It offers features like secret verification and configurable scan intervals, with the ability to scan traffic from various Burp Suite tools beyond just the proxy. |