Burp learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Burp Suite Extensions - Overview and Introduction with Kotlin
   6 min readscip.ch2026
   Library for developing Burp Suite extensions, focusing on the modern MontoyaApi with Kotlin. This resource details how to create powerful extensions, introducing concepts like Bambdas for filtering and BChecks for custom scan checks. It showcases the development of the HeaderMate extension, which automates server response header evaluation against OWASP recommendations and configurable rules, offering features like selective host checking, issue creation toggling, and CSV export.
2. Burp Suite - Top Extensions | KSEC ARK Pentesting Knowledge Base
   13 min readivoidwarranties.tech2026
   Library of Burp Suite extensions includes tools for detecting vulnerable JavaScript libraries with Retire.js, identifying authorization flaws via Autorize, testing JOSE/JWE with JOSEPH, logging requests/responses with Logger++, and enhancing active scanning with ActiveScan++. Specific vulnerabilities mentioned include Drupalgeddon (CVE-2014-3704), Joomla SQL injection (CVE-2017-8917), WordPress SQL injection in plugins, CSRF, and numerous SSL vulnerabilities such as Heartbleed and POODLE.
3. My First Burp Suite Extension
   9 min readitsecguy.com2025
   Library for developing custom Burp Suite extensions in Java. This project details the creation of a simple extension that checks for specific HTTP response headers, demonstrating how to set up the development environment, implement `IBurpExtender` and `IScannerCheck` interfaces, and define custom `IScanIssue` objects for reporting findings. The code is available on GitHub.
4. API Testing with Insomnia and Burp Suite: An Alternative to Postman
   8 min readwafflesexploits.github.io2024
   Library for API testing and hacking, demonstrating how to use Insomnia and Burp Suite as an alternative to Postman. It details capturing API requests with mitmproxy, converting them to OpenAPI 3.0 format using mitmproxy2swagger for import into Insomnia, and leveraging Insomnia's features like variable management and Burp Suite integration for testing vulnerabilities such as Improper Asset Management.
5. My First Burp Suite Extension
   9 min readitsecguy.com2020
   Library for creating custom Burp Suite extensions, written in Java. This resource details the process of setting up a Java IDE like Netbeans to debug extensions directly within Burp Suite, implementing the `IBurpExtender` and `IScannerCheck` interfaces, and constructing `IScanIssue` objects to report findings. The example extension checks for the presence of specific response headers during passive scans.

Real testing methodology, tooling, and writeups that show the work.

1. Writing Burp Bambda Filters Like a Boss
   7 min readdanaepp.com2025
   Library for creating custom Burp Suite Proxy HTTP history filters using Java snippets. This feature, named "Bambdas," allows for advanced filtering beyond standard options, such as identifying specific JWT algorithms like HS512 within Authorization headers. Users can write and save these filters via the UI, leveraging interfaces like `ProxyHttpRequestResponse` and `Utilities` for complex request analysis.
2. SulphurAPI: Burp Suite extension for automating OWASP API Top 10 detection
   github.com2026
   Extension for automating OWASP API Top 10 detection within Burp Suite. SulphurAPI includes checks for mass assignment, authentication, and authorization vulnerabilities, alongside OpenID Connect/OAuth2 management and advanced OpenAPI parsing for versions 2.0 to 3.1.1.
3. MantisSTS/JSReconduit: Passive JavaScript reconnaissance for penetration testers — bridging Burp Suite traffic into structured, AST-based analysis in VSCode.
   5 min readgithub.com2026
   Library bridging Burp Suite traffic into VSCode for passive JavaScript reconnaissance. It captures JavaScript assets via a Burp Suite extension and performs Abstract Syntax Tree (AST) analysis within VSCode, rendering findings like API endpoints, routes, drift detection, clusters, dataflow traces, and secrets. The tool supports source-to-sink tracing, lazy chunk extraction, optional deobfuscation, and various export formats including JSON, CSV, and SARIF. Custom signature packs can be integrated for enhanced detection.
4. repplus/rep: rep+ — Burp-style HTTP Repeater for Chrome DevTools with built‑in AI to explain requests and suggest attacks
   7 min readgithub.com2026
   Library: rep+ is a Chrome DevTools extension mimicking Burp's Repeater, enhanced with AI. It captures and replays HTTP requests without proxy setup, offering features like multi-tab capture, hierarchical grouping, and robust filtering. Built-in AI can explain requests, suggest attack vectors, and modify requests directly. It supports detailed secret and endpoint extraction, parameter risk assessment, and generates Postman collections. rep+ integrates with Claude, Gemini, and Ollama, featuring a chat interface for contextual analysis across multiple requests, and offers extensive theming options.
5. Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage.
   38 min readgithub.com2025
   Library for comprehensive API security testing within Burp Suite. It consolidates 15 attack types, including BOLA, IDOR, SQLi, and GraphQL specific vulnerabilities, leveraging over 108 payloads and intelligent fuzzing. Features include automated reconnaissance, smart normalization of API endpoints, AI integration for payload generation, and seamless integration with external tools like Nuclei, Turbo Intruder, HTTPX, and SQLMap. It covers the OWASP API Top 10 and offers differential-first logic coverage and token lifecycle drift analysis.

Novel research, edge cases, and the techniques that push the class forward.

1. Developing AI features in Burp extensions
   7 min readportswigger.net2026
   Library for integrating AI capabilities into Burp Suite extensions via the Montoya API. This resource details how extensions must declare AI feature support using `EnhancedCapability.AI_FEATURES` and verify availability with `Ai.isEnabled()`. It explains sending single-shot and multi-turn prompts using `Message` objects for system, user, and assistant roles, and handling responses through `PromptResponse`.
2. The Future of Security Testing: AI-Powered Extensibility in Burp
   3 min readportswigger.net2026
   Library for AI-powered extensibility in Burp Suite Professional, leveraging the Montoya API to integrate AI capabilities for enhanced security testing and automation. This allows for seamless integration of AI, exemplified by Gareth Heyes' enhanced Hackvertor extension, which enables custom transformations without coding. Users receive free AI credits to experiment and build their own AI-powered extensions, with options to submit them to the BApp store.
3. Turbo Intruder: Embracing the Billion-Request Attack
   8 min readportswigger.net2026
   Library for high-speed, scalable web application attacks. Turbo Intruder is a Burp Suite extension built from scratch with a custom HTTP stack, outperforming many asynchronous scripts. It supports flexible Python-based attack configuration for complex needs like signed requests, handles malformed requests, and filters results with an advanced diffing algorithm. It can achieve millions of requests with flat memory usage, and offers command-line operation for optimized performance by co-locating with targets.