Professional

Creating custom actions

• Last updated: March 31, 2025

• Read time: 3 Minutes

Custom actions are powered by Bambdas, which are snippets of code that run directly from Burp's interface. You can write your own Bambdas using Java to meet your specific testing requirements.

Before you start

Before you begin writing, gather inspiration and check for existing solutions:

• Explore our Bambdas GitHub repository. - You may find an existing Bambda that already meets your needs or provides inspiration for writing your own.

• Join the conversation - Connect with other Bambda developers on the PortSwigger Discord #bambdas channel to discuss ideas and get feedback.

• Review our acceptance criteria - If you plan to submit your Bambda to our GitHub repository, check our submission guidelines to make sure it meets our acceptance criteria.

Creating Bambdas

You can create new Bambdas using built-in templates or from a blank definition.

Five objects of the Montoya API are available to help you write your custom action Bambdas:

• HttpRequestResponse

• RequestResponseSelection

• MontoyaApi

• Utilities

• Logging

To create a new custom action:

1. In Repeater, click Custom actions. The Custom actions side panel opens.

2. Click New and select either Blank or From template. The Custom actions editor dialog opens.

3. If you selected From template, select a Custom action template from the list, then click Create using this template.

4. Write your custom action Bambda using Java.

5. Test the custom action using the built-in test function. For more information, see Testing custom actions.

6. [Optional] Click Save to library > Save. The Bambda is saved to your Bambda library for future use.

7. Click OK.

8. If the Bambda is error-free, it's added to the Custom actions side panel.

9. If errors exist, they appear in the Compilation errors panel. You'll need to fix these before you can add the Bambda to the list. For more information, see Troubleshooting Bambdas.

Testing custom actions

When adding or editing a custom action Bambda, you can test its behavior using the built-in test function. This enables you to confirm that the action performs as expected.

To test a custom action Bambda in the Custom actions editor:

1. Review the sample message under Request. Optionally, replace it with the specific request you'd like to test the rule against.

2. Click Test. Burp runs the custom action Bambda on the sample message.

3. Review any output in the Console tab.

4. Adjust the custom action as necessary.

5. To restore the sample message, click .

How Burp selects test data

The test function automatically uses the open request, response, and HTTP service from the current Repeater tab when you open the Custom actions editor.

The HTTP service is the destination host, port and protocol. For example, https://example.com:443. If this information isn't available, Burp uses a null HTTP service instead. This can impact how your custom action behaves during testing, especially if it:

• Makes follow-up requests.

• Logs information about the target service.

• Processes messages based on host or protocol.