The newest Burp Suite resources are on the Burp Suite page. For a reading order instead of a date order, see the Burp Suite learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-02-01 2025 | A Burpsuite Extension For JS Reconnaissance - Jsmon intermediate 2 min read Recon | Extension for Burpsuite that integrates Jsmon's JavaScript scanning and monitoring capabilities, automatically analyzing HTTP history for client-side exposures and secrets. Features include automatic or manual analysis, scope filtering to optimize API calls, and seamless integration within Burpsuite's workflow for enhanced web security testing. |
| 2025-01-30 2025 | BChecks - IntelliJ IDEs Plugin | Marketplace intermediate | Provides support for the BCheck language, used to provide custom scan checks for Burp Suite Professional and Burp Suite Enterprise. Key features: Syntax highlighting... |
| 2025-01-28 2025 | GitHub - IckoGZ/burp-deepseek: A quick and dirty (and a little shitty) burp extension that uses cheap deepseek api to send request and response and maybe found something interesting. intermediate 3 min read | Library integrating the DeepSeek API into Burp Suite for AI-driven security analysis. This beta-stage plugin allows users to send HTTP requests and responses from Burp Suite's Proxy or Repeater to DeepSeek for vulnerability detection and sensitive data identification. It features context menu integration, asynchronous API calls, customizable prompts, and generates "DeepSeek Analysis" issues within Burp's Scanner. |
| 2024-12-31 2024 | GitHub - hackerassociate/SSRF-Hacks-IP-Decimal: A Burp Suite extension that converts IP addresses to decimal notation, useful for SSRF bypass and WAF evasion testing. Created by Harshad Shah. intermediate 1 min read SSRF | Extension for Burp Suite that converts IPv4 addresses to decimal notation. Developed by Harshad Shah, this tool aids penetration testers in bypassing security controls by automatically replacing IP addresses within requests with their decimal equivalents. It integrates into the context menu and logs conversions, proving useful for SSRF bypass and WAF evasion testing. |
| 2024-12-12 2024 | API Testing with Insomnia and Burp Suite: An Alternative to Postman beginner 8 min read API Sec | Library for API testing and hacking, demonstrating how to use Insomnia and Burp Suite as an alternative to Postman. It details capturing API requests with mitmproxy, converting them to OpenAPI 3.0 format using mitmproxy2swagger for import into Insomnia, and leveraging Insomnia's features like variable management and Burp Suite integration for testing vulnerabilities such as Improper Asset Management. |
| 2024-12-03 2024 | burp-extensions-montoya-api-examples/customlogger/src/main/java/example/customlogger/MyTableModel.java at main · PortSwigger/burp-extensions-montoya-api-examples intermediate 1 min read | Library example demonstrating how to create a custom table model within a Burp Suite extension using the Montoya API. This code snippet focuses on logging HTTP responses, specifically capturing the `toolSource` and the URL of the `initiatingRequest`, and displaying them in a tabular format. The `MyTableModel` class extends `AbstractTableModel` and manages a list of `HttpResponseReceived` objects, providing methods for adding new entries and retrieving data for display. |
| 2024-12-03 2024 | Hacking API discovery with a custom Burp extension intermediate 8 min read API Sec | Library for enhancing API discovery within Burp Suite, this extension dynamically generates over 4,000 potential API documentation paths, including Swagger and OpenAPI formats, and recursively checks discovered directories. It employs an exponential backoff strategy for resilient requests and utilizes parallel processing to accelerate the discovery of API documentation artifacts. → danaepp.com |
| 2024-12-03 2024 | Burp-Montoya-Utilities/src/main/java/com/coreyd97/BurpExtenderUtilities/PopOutPanel.java at master · CoreyD97/Burp-Montoya-Utilities intermediate 3 min read | Library code for a Burp Suite extension featuring a `PopOutPanel` component. This Java class enables users to detach and display Swing components in a separate JFrame, offering functionality to pop components in and out of their original context within the Burp Suite interface. |
| 2024-11-29 2024 | Python Twisted proxy - how to intercept packets intermediate Python | Library for intercepting HTTP request and response bodies using Python's Twisted framework. This resource demonstrates how to build a simple proxy that logs and potentially modifies traffic, enabling detailed analysis and manipulation of web communication. → stackoverflow.com |
| 2024-11-25 2024 | burp-extensions-montoya-api-examples/collaborator/src/main/java/example/collaborator/CollaboratorExample.java at main · PortSwigger/burp-extensions-montoya-api-examples · GitHub intermediate 1 min read | Library demonstrating the use of the Burp Collaborator Client API within a custom extension. This example shows how to create or restore a `CollaboratorClient`, log interactions received, register a request handler, and poll for new interactions periodically. It includes code for persisting the Collaborator secret key using `PersistedObject` to allow for client restoration across extension reloads, and graceful shutdown of the polling mechanism. |
| 2024-10-05 2024 | Mindmap/Burp Suite/Burp Suite Normal.png at main · Ignitetechnologies/Mindmap beginner | This repository will contain many mindmaps for cyber security technologies, methodologies, courses, and certifications in a tree structure to give brief details about them - Ignitetechnologies/Mindmap |
| 2024-10-03 2024 | Top 10 Browser Extensions Every Bug Bounty Hunter Needs beginner Bug Bounty | As bug bounty hunters, we need to save time by avoiding constant switching between the terminal, multiple tabs, Burp Suite (including… |
| 2024-09-21 2024 | Proving API exploitability with Burp Collaborator intermediate 5 min read API Sec | Library for demonstrating API exploitability using Burp Collaborator. This technique leverages out-of-band application security testing (OAST) to prove vulnerabilities like insecure deserialization, SSRF, open redirects, and blind XXE without requiring reverse shells. It works by sending crafted payloads that interact with Burp Collaborator's mock network services, capturing DNS, HTTP/HTTPS, or SMTP interactions to confirm an attack's potential. The article details how to configure and use Burp Collaborator, referencing its application in testing CVE-2023-40044 and crAPI. → danaepp.com |
| 2024-08-30 2024 | GitHub - e1abrador/Burp-Encode-IP: Burp Suite extension to encode an IP address focused to bypass application IP / domain blacklist. intermediate 3 min read | Library for Burp Suite that encodes IP addresses using various techniques like Unicode, IPv6 formats, hexadecimal, octal, and mixed integer representations. It aims to bypass application IP or domain blacklists, aiding in testing SSRF, Open Redirect, and RFI vulnerabilities. The extension also supports DNS rebinding and collaborator integration for advanced testing scenarios. |
| 2024-08-22 2024 | BChecks/vulnerability-classes/injection at main · PortSwigger/BChecks · GitHub beginner RCE SQLi XSS | BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition - PortSwigger/BChecks |
| 2024-08-16 2024 | GitHub - 0x999-x/jsluicepp: jsluice++ is a Burp Suite extension designed for passive and active scanning of JavaScript traffic using the CLI tool jsluice intermediate 5 min read | Extension integrating the jsluice CLI tool with Burp Suite for passive and active scanning of JavaScript traffic. It extracts URLs, paths, and secrets from JavaScript files, offering features like context menu processing, passive proxy scanning, URL monitoring with diff detection, and sending findings to Repeater. It also supports secret detection and scoped processing. |
| 2024-08-03 2024 | Testing Handbook - Burp beginner Talks | Watch the recording Testing Handbook: Burp Suite Professional https://appsec.guide → docs.google.com |
| 2024-08-03 2024 | Mastering Web Research with Burp Suite beginner | Mastering Web Research with Burp Suite |
| 2024-08-02 2024 | GitHub - synacktiv/HopLa: HopLa Burp Suite Extender plugin - Adds autocompletion support and useful payloads in Burp Suite intermediate 4 min read | Library enhancing Burp Suite with AI-powered autocompletion, chat, and request transformation. Integrates with OpenAI, Gemini, and Ollama, offering dynamic payload insertion, collaborator domains, and custom keyword management. Supports extensive YAML-based payload customization and hotkeys for efficient testing, building upon concepts from PayloadsAllTheThings. |
| 2024-07-30 2024 | Here's how I get the most out of Burp Suite reporting intermediate 9 min read | Library for extracting detailed vulnerability data from Burp Suite Professional, enabling comprehensive reporting. It covers generating HTML reports from scanner findings, including full requests and responses, and exporting raw HTTP history from Proxy and Repeater tabs as XML. The library facilitates structured reporting for both technical and non-technical audiences by providing access to scan results, proxy logs, and repeater sessions, crucial for effective vulnerability communication. → danaepp.com |
| 2024-07-30 2024 | JS Link Finder Burp Suite Extension Guide intermediate Bug Bounty | Improve your bug bounty hunting, pentesting, and appsec skills with the JS Link Finder Burp Suite Extension. Discover hidden endpoints and… |
| 2023-12-06 2023 | videos[1] = "GAP Burp Extension" intermediate | videos[1] = "GAP Burp Extension" https://www.youtube.com/watch?v=Os3bN0zUROA |
| 2023-11-07 2023 | Example Collaborator-based check intermediate 2 min read | BCheck for detecting SSRF vulnerabilities using Burp Collaborator. This check inserts a Burp Collaborator interaction ID into the Referer header of requests. If Burp Collaborator receives any interactions in response, an SSRF issue is reported with high severity and firm confidence, indicating the target fetches arbitrary URLs from the Referer header. → portswigger.net |
| 2023-11-03 2023 | Burp Suite Shorts | Automatic Session Handling beginner AuthN | The content is a video titled "Burp Suite Shorts | Automatic Session Handling" available on YouTube. It likely provides a concise tutorial or demonstration on how to utilize automatic session handling within the Burp Suite tool. This feature can streamline the process of managing and maintaining sessions during security testing and web application assessments. Viewers can expect to learn how to automate session handling tasks to enhance efficiency and effectiveness in their security testing workflows. |
| 2023-11-03 2023 | Burp Suite Shorts | Automatic Session Handling intermediate AuthN | Burp Suite Shorts | Automatic Session Handling https://www.youtube.com/watch?v=yoENNJjC4NY |
| 2023-10-29 2023 | PortSwigger/BChecks: BChecks collection for Burp Suite Professional intermediate 2 min read | Library of BChecks written in the BChecks language for Burp Suite Professional and DAST. This collection includes custom scan checks developed by PortSwigger and the community, covering vulnerabilities like Blind SSRF, exposed git directories, leaked AWS Tokens, Log4Shell, Server Side Prototype Pollution, and suspicious input transformations, with specific checks for CVE-identified vulnerabilities. Documentation, examples, and a definition reference are available for creating and testing your own BChecks. |
| 2023-10-05 2023 | How to build custom scanners for web security research automation intermediate 5 min read Fuzzing Recon | Library for building custom web security scanners, exemplified by an approach to detect race conditions. It details automating the "probe" phase of manual testing, leveraging concurrent requests and techniques like the single-packet attack, and discusses the use of "gadgets" such as embedded user data to identify race-infoleak vulnerabilities. The library, released as the Backslash Powered Scanner and installable via the Burp Suite BApp store, aims to assist researchers in automating the discovery of under-appreciated attack classes. → portswigger.net |
| 2023-10-04 2023 | A lightweight web security auditing toolkit beginner | Toolkit for web security auditing that enhances manual testing with AI and teamwork. Caido integrates with LLM providers like Anthropic, Google, and OpenAI through OpenRouter, enabling AI-powered plugins and programmatic access via its Client SDK. Features include autonomous agents for payload generation and task execution, precise request/response searching with HTTPQL, and ad-hoc automation via a node-based system. The platform boasts over 6,000 active users, 54+ community plugins, and a Discord community of 4,500+ members. |
| 2023-09-15 2023 | burp.IBurpExtenderCallbacks java code examples intermediate | burp.IBurpExtenderCallbacks java code examples https://ift.tt/je1FMoP |
| 2023-09-03 2023 | Proxying Burp Traffic through VPS using SOCKS Proxy intermediate | Tunnel your BurpSuite traffic through VPS to bypass restrictions using SOCKS proxy. |
| 2023-08-13 2023 | Swing in Python Burp Extensions - Part 1 intermediate 5 min read Python | Library for creating custom Jython Swing GUIs within Burp extensions, detailing the implementation of `ITab` interfaces, `JPanel` layout managers, `JButton` action listeners, `JSplitPane` dividers, `JList` selection events with `ListSelectionListener` and `valueChanged`, `JTabbedPane` for organizing UI elements, and `StyledDocument` for text styling and content insertion into `JTextPane`, as well as loading URLs into `JEditorPane`. |
| 2023-08-03 2023 | Proxying MetaSploit through BurpSuite intermediate | Proxying MetaSploit through BurpSuite https://ift.tt/ZHsxq1m |
| 2023-07-19 2023 | Web App Hacking with Caido.io beginner API Sec | Web App Hacking with Caido.io https://www.youtube.com/watch?v=lW-u_2EByT4 |
| 2023-07-02 2023 | DNS Analyzer - Finding DNS vulnerabilities with Burp Suite intermediate 7 min read Recon | Library for discovering DNS vulnerabilities in web applications. This Burp Suite extension leverages Burp Collaborator to analyze DNS name resolution, helping identify potential abuse of "Forgot password?" features for account takeovers, reminiscent of Kaminsky-style attacks. It provides a Kaminsky status, scatter plots, and statistics to assess the predictability of UDP source ports and DNS IDs in DNS queries, offering a more accessible alternative to setting up dedicated DNS analysis servers. |
| 2023-06-17 2023 | Web Application Hacking with Burp Suite beginner 1 min read | Library of hands-on exercises for mastering Burp Suite, covering information disclosure, insecure decentralization, web socket testing, directory traversal, XXE, XSS, and SQL injection vulnerabilities. This course emphasizes practical application, guiding users through tool setup and real-world examples to equip them for comprehensive web application security testing. |
| 2023-05-29 2023 | RepeaterSearch intermediate Fuzzing | Extension that adds a search bar to Burp Suite's Repeater tab. This tool enables users to efficiently locate requests and/or responses containing a specific string, with support for both simple text matching and regular expressions. It highlights matching repeater tabs, streamlining the process of analyzing and identifying vulnerabilities within HTTP traffic. |
| 2023-04-13 2023 | How to use Burp Suite Like a PRO? beginner | How to use Burp Suite Like a PRO? https://ift.tt/fbstnRg |
| 2023-04-09 2023 | aress31/burpgpt intermediate 7 min read AI | Library leveraging OpenAI's GPT models to detect security vulnerabilities missed by traditional scanners. BurpGPT integrates with Burp Suite, sending web traffic for analysis via customizable prompts and a placeholder system, generating automated reports of potential issues. It supports various OpenAI models, allows granular control over token usage and prompt length, and offers example use cases for tailored analysis, such as identifying CVE-related library flaws or biometric authentication vulnerabilities. |
| 2023-02-17 2023 | Burp Suite Extensions Rarely Utilized but Quite Useful beginner | The content discusses the underutilization of Burp Suite extensions despite their usefulness. It highlights that these extensions can enhance the functionality of Burp Suite, aiding in various security testing tasks. The article likely delves into the benefits of utilizing these extensions, such as improving efficiency, expanding capabilities, and enhancing the overall experience of using Burp Suite for security testing purposes. Overall, it emphasizes the value of exploring and incorporating these extensions into one's workflow to maximize the potential of Burp Suite. |
| 2023-02-16 2023 | A Step-by-Step Guide to Writing Extensions for API Pentesting in BurpSuite intermediate 11 min read | Library for creating custom BurpSuite extensions in Python, focusing on API penetration testing. It guides users through setting up a development environment with Jython, writing a basic "Hello World" extension, and then constructing a more advanced "UUID Inspector" that identifies v1 UUIDs during passive scans, registering them as issues in BurpSuite's dashboard. → danaepp.com |
| 2022-06-20 2022 | Favorite tweet by @Burp_Suite news XSS | Favorite tweet: Burp Suite 2022.6 released to the Early Adopter channel. Includes grouped tabs for Repeater, connection reuse for HTTP/1 requests, and new preset scan modes. Also introduces the abili... |
| 2022-06-20 2022 | Favorite tweet by @PortSwigger news XSS | Favorite tweet: Finding Client-Side Prototype Pollution (CSPP) with DOM Invader by @garethheyes - now available on the Early Adopter channel https://t.co/ut1Buup1so — PortSwigger (@PortSwigger) Jun ... |
| 2022-04-20 2022 | Favorite tweet by @Jhaddix beginner | Favorite tweet: Asking for a friend: What's the current best low-cost, self-study, Burp Suite training out there? — Jason Haddix (@Jhaddix) Apr 19, 2022 |
| 2022-04-14 2022 | Favorite tweet by @e11i0t_4lders0n news Bug Bounty XSS | Favorite tweet: Burp Extension for XSS Thread 🧵 #bugbounty #bugbountytip #bugbountytips — Tushar Verma 🇮🇳 (@e11i0t_4lders0n) Apr 14, 2022 |
| 2022-03-21 2022 | Favorite tweet by @cedoxX intermediate | Favorite tweet: Nuclei-Burp-Plugin - A @Burp_Suite plugin intended to help with Nuclei template generation. https://t.co/wseZPcgBE0 @KitPloit #RedTeam #Tools #Cyber #Hacker #BugBounty #Hacking https:... |
| 2022-03-06 2022 | Favorite tweet by @fardeenahmed411 news Bug Bounty Recon | Favorite tweet: Top 10 essential tools for Bug-Bounty Hunting : 1. Burp Suite / ZAP-Proxy 2. Google Dorking Script 3. DNS-Discovery 4. Reverse IP Lookup 5. Wapiti 6. INalyzer 7. IronWASP 8. Wfuzz 9. ... |
| 2022-03-02 2022 | Favorite tweet by @ptracesecurity intermediate Recon | Favorite tweet: Nuclei-Burp Extension: run nuclei scanner directly from burp https://t.co/5eXxgjapf7 #Pentesting #BurpSuite #WebSecurity #Infosec https://t.co/xwhsoQfhRo — Ptrace Security GmbH (@ptr... |
| 2022-01-03 2022 | BUG BOUNTY HUNTING WITH BURP SUITE beginner Bug Bounty | BUG BOUNTY HUNTING WITH BURP SUITE |
| 2021-11-22 2021 | Burp Suite for Pentester: Software Vulnerability Scanner & Retire.js beginner 7 min read | Library for Burp Suite, "Software Vulnerability Scanner" leverages the vulners.com API to identify software versions vulnerable via CPE fingerprints or path matching. It also includes "Retire.js" to detect outdated JavaScript libraries within web applications. |
| 2021-10-29 2021 | Improvements to Burp Suite authenticated scanning intermediate 4 min read AuthZ | Library improvements to Burp Suite's authenticated scanning in version 2021.9.1 enhance testing of complex web applications by enabling recording and replay within iframes. The update addresses issues with animated elements, SVG icons within buttons, and JavaScript-driven redirections, improving accuracy and efficiency. It also adds support for multi-select elements, further streamlining the process of scanning privileged areas of modern web applications. → portswigger.net |
