DOCSEARCHbyAlgolia
Submit Docs

Awesome Burp Extensions

repository·master·Indexed 25 days ago

https://github.com/snoopysecurity/awesome-burp-extensions

A curated collection of high-quality Burp Suite extensions designed to enhance security testing. The list includes categorized tools for vulnerability scanning (passive and active), request/response manipulation, OAuth and SSO testing, JWT analysis, cloud security, and information gathering and discovery.

Tokens
8.7K
Snippets
10
Records
35
Agent score
36%

What's inside awesome-burp-extensions

  1. Explore Burp Suite Scanners

    master

    The awesome-burp-extensions repository maintains a curated list of Burp Suite extensions categorized by functionality. The Scanners category includes both passive and active scan plugins designed to automate vulnerability detection.

    Key scanner types available in this list include:

    • General Vulnerability Scanners: Tools like ActiveScan++, Burp Vulners Scanner, and Burp Molly Pack.
    • Injection Scanners: Specialized tools for SQL/NoSQL Injection, Command Injection, Cypher Injection, and Log4j vulnerabilities.
    • Protocol & Configuration Scanners: Extensions for HTTP Request Smuggling, CSP (Content Security Policy) analysis, OAuth/SSO, and DNS vulnerabilities.
    • Framework Specific Scanners: Tools targeting J2EE, WordPress, AEM (Adobe Experience Manager), and GWT (Google Web Toolkit).
    • Client-Side Scanners: Extensions for JavaScript analysis, DOM scanning, and HTML5 auditing.

  2. Explore Custom Burp Suite Extensions

    master

    The awesome-burp-extensions repository maintains a curated list of extensions designed to customize Burp Suite features and extend its functionality. These extensions cover various categories such as:

    • Scanning & Vulnerability Detection: Improving active/passive scanners (e.g., Burp Bounty), detecting attack surfaces (Attack Surface Detector), and identifying indicators of vulnerability (Burp-IndicatorsOfVulnerability).
    • Request/Response Manipulation: Tools for decoding/encoding (Hackvertor, Decoder Improved), minimizing requests (Request Minimizer), and modifying traffic via GUI (cstc).
    • WebSocket Testing: Enhancing WebSocket capabilities (SocketSleuth, WebSocket Turbo Intruder, PyCript WebSocket).
    • UI & Workflow Enhancements: Improving the user interface (BurpSuiteSharpener), managing bookmarks (Bookmarks), and providing multi-stage repeater functionality (Stepper).
    • Specialized Protocols & Technologies: Tools for Android Binder (BadIntent), Blazor (BlazorTrafficProcessor), WebAuthn (WebAuthn CBOR Decoder), and DOM rendering (reDOM).
    • Automation & Utilities: Automating request dropping (Auto-Drop Requests), IP rotation (IP Rotate), and regex-based extraction (Response Grepper, HaE).

  3. Integrate Burp Suite with external security platforms and tools

    master

    The 'Tool Integration' category contains Burp Suite extensions designed to bridge Burp with external vulnerability management, collaboration, and reconnaissance platforms. Use these extensions to automate the flow of findings, import external data into the Burp sitemap, or collaborate with other security professionals.

    Key integration types include:

    Vulnerability Management & Reporting

    • ElasticSearch: Use Report To Elastic Search to pass issues to stdout or an ElasticSearch database, or ElasticBurp to store requests/responses in an ElasticSearch index.
    • Qualys: Use Qualys WAS to push findings to the Qualys Cloud Platform.
    • CodeDx: Use Code Dx to upload scan reports directly to the CodeDx management system.
    • ThreadFix: Use Threadfix to interface with ThreadFix.
    • Nucleus: Use Nucleus Burp Extension to push scans to the Nucleus platform.
    • Dradis: Use Drasis Framework to integrate with Dradis.
    • Faraday: Use Faraday to integrate with the Faraday Integrated Penetration-Test Environment.
    • Issue Poster: Use Issue Poster to post scanner issue details to external web services.

    Data Import & Parsing

    • Nmap: Use NMAP Parser to parse Nmap output files and add web ports to the target scope.
    • Nessus: Use Nessus Loader to parse Nessus XML files and add discovered web servers to the sitemap.
    • Pcap: Use Pcap Importer to import Pcap/Pcap-NG files into the Target sitemap for passive scanning.
    • ZAP/wstalker: Use Import To Sitemap to import wstalker CSV or ZAP export files into the Burp Sitemap.
    • Teamserver: Use Burptrast to pull endpoint information from Teamserver into the sitemap.

    Collaboration & Workflow

    • Git: Use Git Bridge to store Burp data and collaborate via git repositories.
    • Chat: Use Burp Chat to enable collaborative usage via XMPP/Jabber.
    • Faction: Use Faction Burp Suite Extension to integrate into the Faction assessment collaboration framework.

    Specialized Security Tooling

    • Frida: Use Brida to bridge Burp Suite and Frida, allowing manipulation of application methods while tampering with traffic.
    • Semgrep: Use Semgrepper to include Semgrep results in the passive scanner checks.
    • Nuclei: Use Nuclei Template Generator Burp Plugin to assist with nuclei template generation.
    • Bug Bounty: Use YesWeBurp to access YesWeHack bug bounty programs directly within Burp.

  4. Use the Awesome Burp Extensions list

    master

    This repository is a curated list of Burp Suite extensions. To find specific tools for your security testing needs, you can:

    • Use Command + F (or Ctrl + F) to search the page for specific keywords or functionality.
    • Navigate through the categorized Content menu to browse extensions by type or use case.

  5. Perform Information Gathering and Discovery

    master

    Use these extensions to enhance discovery, spidering, and asset enumeration within Burp Suite:

    Discovery & Spidering

    • Google Hack: GUI for running Google Hacking queries and adding results to the site map.
    • PwnBack/Wayback Machine: Generates a sitemap using the Wayback Machine.
    • Burp CSJ: Integrates Crawljax, Selenium, and JUnit to increase crawling capability.
    • Attack Surface Detector: Uses static code analysis to identify endpoints by parsing routes and parameters.
    • Add to sitemap++: Reads URLs from files or the clipboard and adds them to the site map of selected hosts.
    • Site Map Fetcher: Fetches responses for unrequested items in the site map.

    Asset & Domain Enumeration

    • domain_hunter: Finds sub-domains, similar domains, and related domains.
    • Subdomain Extractor: Exports subdomains via a context menu option.
    • SAN Scanner: Enumerates associated domains and services via SSL certificate Subject Alt Names.
    • AdminPanelFinder: Enumerates infrastructure and application Admin Interfaces.
    • Asset Discover: Discovers assets from HTTP responses via passive scanning.
    • Dr. Watson: Finds assets, keys, subdomains, and IP addresses.
    • BigIP Discover: Detects private IPs included in BigIP server cookies.

    Data Import & Filtering

    • Directory File Listing Parser Importer: Parses directory/file listing text files into Burp.
    • DirectoryImporter: Imports directory bruteforcing results for viewing.
    • Site Map Extractor: Extracts information from the full or in-scope site map.
    • Filter OPTIONS Method: Filters out OPTIONS requests from the Proxy history.

  6. Access Burp Extension training resources

    master

    The repository provides a curated list of external training resources for developers looking to build Burp Suite extensions. These resources include:

    • Generators & Frameworks: Burp Extension Generator.
    • Official Documentation: PortSwigger's guide on "Writing your first Burp Suite extension".
    • Language-Specific Guides: Tutorials for Java (n00bs guide, nVisium intro) and Python (OWASP presentation, Jython automation).
    • Workshops & Series: Doyensec's development training, Sanoop Thomas's Writing Workshop, and Prakhar Prasad's development series.
    • Video Tutorials: Various talks from BSidesCHS, OWASP, and eLearnSecurity covering building extensions and using specific tools like the CO2 extension.

  7. Assess OAuth and SSO applications

    master

    Use the following Burp Suite extensions to test Single Sign-On (SSO), SAML, OAuth, and JWT implementations:

    SAML Testing

    • SAML Raider: Manipulate SAML messages and manage X.509 certificates.
    • SAML Encoder/Decoder: Adds a UI tab for encoding/decoding SAML messages.
    • SAML Editor: Adds a tab to the HTTP message editor for encoding/decoding SAML.
    • SAMLReQuest: View, decode, and modify SAML requests and responses.
    • Dupe Key Injector: Implements Dupe Key Confusion (XML signature bypass technique).

    OAuth & SSO

    • Burp OAuth: General OAuth plugin.
    • EsPReSSO: Highlights SSO messages in the Burp proxy window.
    • OAUTHScan: Provides automatic security checks for OAuthv2 and OpenID standards.
    • OAuthv1 - Signing: Provides authentication support for OAuth v1.
    • PeopleSoft Token Extractor: Specifically for testing PeopleSoft SSO tokens.
    • AuthHeader Updater: Specifies token values for the Authentication header during scans.
    • JWT Re-auth: Caches tokens from an 'auth' URL and adds them as headers to requests in a specific scope.

    JSON Web Token (JWT) Testing

    • JSON Web Token Attacker: Tests applications using JWS/JWE.
    • JSON Web Tokens: Decodes, manipulates, and automates attacks against JWTs.
    • JWT Editor: Creates and edits JSON Web Tokens.
    • SignSaboteur: Edits, signs, and verifies various signed web tokens.

  8. Convert Burp requests to cURL commands

    master

    Several extensions are available to convert Burp requests into cURL commands for use in terminal environments:

    • Curlit: A Python plugin to turn requests into curl commands.
    • burp-suite-paste-curl: Allows pasting cURL commands into a new tab in Repeater, parsing them into raw HTTP requests.
    • Copy Headers As -H Arguments: Adds a context menu entry to copy headers from a selected request as -H arguments.
    https://github.com/faffi/curlit/tree/b5cf116d4716376e36cb0e522bdfe90915a7a961
https://github.com/augustd/burp-suite-paste-curl
https://github.com/n0kovo/burp-copy-headers-as-args

  9. Find XXE, File Upload, and Directory Traversal extensions

    master

    Specialized tools for XML and file-related vulnerabilities:

    XXE

    • Office OpenXML Editor: Edit Office Open XML documents (xlsx, docx, pptx).
    • Content Type Converter: Converts between XML, JSON, and x-www-form-urlencoded.

    Insecure File Uploads

    • Upload Scanner: Security tests for HTTP file uploads.
    • ZIP File Raider: ZIP File Payload Testing.
    • File Upload Traverser: Verifies if file uploads are vulnerable to directory traversal.

    Directory Traversal

    • Uploader: Tests for directory traversal in insecure file uploads.
    • off-by-slash: Detects alias traversal via NGINX misconfiguration.

  10. Find Session Management extensions

    master

    Tools for managing authentication, tokens, and session behavior:

    • WAFDetect: Passively detects WAF presence.
    • TokenJar: Manages anti-CSRF, CSurf, and Session IDs.
    • Token Incrementor: Increments a parameter in each request (useful for Active Scan).
    • Token Extractor: Extracts tokens from responses and replaces them in requests.
    • Session Auth: Identifies authentication privilege escalation.
    • Session Timeout Test: Determines server-side session timeout duration.
    • Session Tracking Checks: Checks for known session tracking sites.
    • ExtendedMacro: Extended version of Burp Suite macro feature.
    • AuthHeader Updater: Specifies token value for the Authentication header during scanning.
    • Request Randomizer: Places a random value into a specified location within requests.
    • BearerAuthToken: Tests Enterprise applications involving Bearer tokens.
    • Burp Wicket Handler: Used with Session Handling to record macros.
    • Add Request to Macro: Adds a request to an existing macro.
    • Cookie Decrypter: Decrypts/decodes various types of cookies.
    • Authentication Token Obtain and Replace (ATOR): Helps automated scanning in specific session scenarios.
    • Session-Handler-Plus (SH+): Enhanced handling for JWTs, access tokens, refresh tokens, and CSRF tokens; supports custom scripts and Selenium automation.