Support Center

Burp Community

See what our users are saying about Burp Suite:

How do I?

New Post View All

Feature Requests

New Post View All

Burp Extensions

New Post View All

Bug Reports

New Post View All

Burp Suite Documentation

Take a look at our Documentation section for full details about every Burp Suite tool, function and configuration option.

Full Documentation Contents Burp Projects
Suite Functions Burp Tools
Options Using Burp Suite

Burp Extender

Burp Extender lets you extend the functionality of Burp Suite in numerous ways.

Extensions can be written in Java, Python or Ruby.

API documentation Writing your first Burp Suite extension
Sample extensions View community discussions about Extensibility
Support Center BApp Store

BApp Store

The BApp Store contains Burp extensions that have been written by users of Burp Suite, to extend Burp's capabilities.

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for all BApp Store extensions on our GitHub page.

Masks verbose parameter details in .NET requests.
Extends Burp's active and passive scanning capabilities.
Provides some additional passive Scanner checks.
Allows encryption and decryption of AES payloads in Burp Intruder and Scanner.
Provides a simple way to test authorization in web applications and web services.
Helps test for authorization vulnerabilities.
Automatically detects authorization enforcement.
Finds unknown classes of injection vulnerabilities.
Generates multiple scan reports by host with just a few clicks.
Generates and fuzzes custom AMF messages.
Generates Intruder payloads using the Radamsa test case generator.
Automatically renders Repeater responses in Firefox.
Adds Ruby scripting capabilities to Burp.
Enables collaborative usage of Burp using XMPP/Jabber.
Integrates Crawljax, Selenium and JUnit into Burp.
Identifies previously submitted inputs appearing in hashed form.
Looks for files, directories and file extensions based on current requests received by Burp Suite.
Adds headers useful for bypassing some WAF devices.
Provides a command-line interface to drive spidering and scanning.
Adds various capabilities including SQL Mapper, User Generator and Prettier JS.
Uploads scan reports directly to CodeDx, a software vulnerability correlation and management system.
Generates comments for selected requests based on regular expressions.
Converts JSON To XML, XML to JSON, body parameters to JSON, and body parameters to XML.
Copies selected request(s) as Python-Requests invocations.
Displays CSP headers for responses, and passively reports CSP weaknesses.
Passively scans for CSP headers that contain known bypasses or other potential weaknesses.
Passively scans for CSRF vulnerabilities.
Provides a sync function for CSRF token parameters.
Hides and automatically handles anti-CSRF token defenses.
Adds a new tab to log all requests and responses.
Provides a simple way to automatically modify any part of an HTTP message.
Speeds up manual testing of web applications by performing custom deserialization.
View and modify compressed HTTP messages without changing the content-encoding.
Passively checks for differing content in JavaScript files and aids in finding user/session data.
Evenly distributes scanner load across targets.
Send Scanner issues to Dradis collaboration and reporting framework.
Stores requests/responses in an ElasticSearch index.
Passively detects detailed server error messages.
Processes and recognizes single sign-on protocols.
Provides a similar but extended version of the Burp Suite macro feature.
Integrates Burp with the Faraday Integrated Penetration-Test Environment.
Provides request history view for all Burp tools.
Lets Burp users store Burp data and collaborate via git.
Lets you run Google Hacking queries and add results to Burp's site map.
Automatically identifies insertion points for GWT (Google Web Toolkit) requests.
Converts data using a tag-based configuration to apply various encoding and escaping operations.
Reports security issues in HTTP headers.
Checks whether a server is vulnerable to the Heartbleed bug.
Scans for usage of risky HTML5 features.
Scans for the HTTPoxy vulnerability.
Checks if a particular URL responds differently to various User-Agent headers.
Passively scans jpeg / png / tiff for embedded GPS, IPTC, and camera-proprietary location information.
Extracts metadata from image files.
Detects potential denial of service attacks in image retrieval functions.
Allows use of file contents and filenames as Intruder payloads.
Lets you include the current epoch time in Intruder payloads.
Posts discovered Scanner issues to an external web service.
Adds scan checks focused on Java environments and technologies.
Performs active and passive scans to detect Java deserialization vulnerabilities.
Performs Java deserialization attacks using the ysoserial payload generator tool.
Generates Java serialized payloads to execute OS commands.
Displays JSON messages in decoded form.
Parses JSWS responses and generates JSON requests for all supported methods.
Allows viewing and editing of JVM system properties.
Adds support for performing Kerberos authentication.
Sends Burp Scanner issues directly to a remote Lair project.
Performs hash length extension attacks on weak signature mechanisms.
Logs requests and responses for all Burp tools in a sortable table.
Allows users to manually create custom issues within the Burp Scanner results.
Allows conversion of MessagePack messages to/from JSON format.
Generates custom Intruder payloads based on the site map.
Aids with documentation of OWASP Testing Guide V4 tests.
Parses Nmap output files and adds common web ports to Burp's target scope.
Lets you take notes and manage external documents from within Burp.
Improves efficiency of manual parameter analysis for web penetration tests.
Adds a custom Scanner check to identify Flex applications vulnerable to CVE-2011-2461 (APSB11-25).
Generates payload lists based on a set of characters that are sanitized.
Imports and passively scans Pcap files.
Provides an additional passive Scanner check for metadata in PDF files.
Allows viewing of PDF files directly within Burp.
Finds PHP object injection vulnerabilities.
Decodes and beautifies protobuf responses.
Allows execution of a custom Python script on each HTTP request and response.
Automatically generates fake source IP address headers to evade WAF filters.
Checks for reflected file downloads.
Monitors traffic and looks for parameter values that are reflected in the response.
This extension generates scripts to reissue selected requests.
Reports issues discovered by Burp to an ElasticSearch database.
Places a random value into a specified location within requests.
Captures response times for requests made by all Burp tools.
Clusters similar responses together.
Integrates with the Retire.js repository to find vulnerable JavaScript libraries.
Detects reverse proxy servers.
Detects same origin method execution vulnerabilities.
Adds a tab to Burp's message editor for decoding/encoding SAML messages.
Adds a tab to Burp's main UI for decoding/encoding SAML messages.
Provides a SAML message editor and a certificate management tool to help with testing SAML infrastructures.
Enables you to view, decode, and modify SAML requests and responses.
Performs custom scanning for vulnerabilities in web applications.
Identifies authentication privilege escalation vulnerabilities.
Determines server session timeout intervals.
Fetches the responses of unrequested items in the site map.
Passively reports server software version numbers.
Enumerates application endpoints via a local source code repository.
Initiates SQLMap scans directly from within Burp.
Parse Swagger files.
Provides an interface to the ThreadFix vulnerability management platform.
Manages tokens and updates request parameters with current values.
Passively reports UUID/GUIDs observed within HTTP requests.
Passively detects web application firewalls from HTTP responses.
Allows Burp to view and modify binary SOAP objects.
Integrates Burp with HP WebInspect.
Displays information about IBM WebSphere Portlet state.
Extends Intruder to aid in testing Web Application Firewalls.
Scrapes all unique words and numbers for use with password cracking
Scans a target server for WSDL files.
Parses WSDL files and generates SOAP requests to the enumerated endpoints.
Adds a new HTTP message editor tab to display X-ChromeLogger-Data in decoded form.
Sends responses to a locally-running XSS-Detector server.
Integrates Yara scanner into Burp Suite.

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

If you have written, or are aware of, an extension that you would like to be included in the BApp Store, please submit your BApp to us.