reburp

A Burp Suite extension that exposes the full Montoya API as a local REST API, with Swagger UI

What is reburp

reburp turns Burp Suite into something you can script. It loads as a Java extension and serves the Montoya API over an HTTP REST API on http://127.0.0.1:9090, with an OpenAPI spec and Swagger UI. Anything you would click in Burp - reading proxy history, sending a request, editing scope, running a scan, decoding a token - becomes a JSON call an agent or a curl line can make.

It pairs with the burp-interaction agent skill so an AI assistant can drive Burp directly.

• What reburp unlocks
• Install
• Load into Burp Suite
• API docs
• Endpoints
• Quick start
• Security
• API coverage
• Notes
• Contributing

What reburp unlocks

Burp features your agent can now drive over REST:

• Scanner - start an active audit or crawl, stop a running task, pull the report
• Intruder & request engine - fuzz, plus a Turbo Intruder-style high-throughput engine (queue, pause, resume, cancel)
• Target site map - iterate and search the whole target tree, not just proxy history
• WebSockets - open a connection and send text/binary frames, not just read history
• Engagement tools - generate a CSRF PoC, discover content, find references, send to decoder
• Access-control testing - replay a request with and without its token and diff the responses, Autorize-style (BOLA/BFLA)
• BChecks & Bambda - import custom scan rules, build filter chains, raise custom issues

Install

Grab the latest reburp-*.jar from Releases, or build it from source (requires Java 17+).

Compatibility

Each reburp release is built against a minimum Burp Suite (Montoya) version. On an older Burp, grab the matching jar from Releases.

Build from source

Load reburp.jar rather than the versioned copy. Burp reloads an extension from the path it was loaded from, and the versioned name changes on every release, so the unversioned one keeps reloading after an upgrade instead of quietly leaving you on the previous build.

If your JAVA_HOME isn't set, point it at your JDK:

Load into Burp Suite

1. Open Burp Suite → Extensions → Installed → Add
2. Extension type: Java
3. Extension file: build/libs/reburp.jar (or the reburp-*.jar you downloaded from Releases)
4. Click Next - the extension starts automatically on port 9090

A reburp tab appears in Burp showing every REST call as it happens.

Each row is one REST call. Selecting it shows the API request and response, plus the request and response reburp sent to the target on your behalf.

API docs

Once loaded, open in your browser:

• Swagger UI: http://127.0.0.1:9090/docs
• OpenAPI spec: http://127.0.0.1:9090/openapi.json

The spec is the source of truth for request and response shapes.

Endpoints

Quick start

Security

The REST server binds 127.0.0.1 only, but the port is unauthenticated and responds to any origin. Anything that can reach localhost:9090 can drive Burp, including a web page open in your browser. Treat the port as trusted-local-only and never expose it beyond loopback.

Because of that, OS command execution is off by default. /api/utils/shell/execute and /api/utils/shell/execute-raw return 403 unless the extension sees this in Burp's own process environment:

With it set, any origin that can reach the port gets remote code execution on the host. Enable it only when you accept that. Every invocation is written to the extension output tab. GET /api/utils/shell/status reports whether it is on and never requires it to be.

API coverage

The "full Montoya API" claim is verified mechanically by tools/api_coverage.py, which the CI build workflow runs on every push and fails if any mappable method is left unexposed. Behaviour is exercised separately by tools/smoke_test.py against a loaded extension.

Notes

• Port is hardcoded to 9090. Change port in BurpRestApiExtension.kt and rebuild if needed.
• Pro-only endpoints (scanner, collaborator) return HTTP 403 on Community edition with an explanatory message.
• Montoya API is compileOnly - it is not bundled; Burp provides it at runtime.
• All responses are JSON. Errors return { "error": "..." }.
• OpenAPI spec is assembled from OpenApiSpec.kt plus fragments in docs/. To add a route group, write a *Paths() and *Schemas() fragment and list it in docs/OpenApiSpecExtra.kt.

Contributing

Issues and pull requests are welcome. Please run python3 tools/api_coverage.py and ./gradlew shadowJar before opening a PR. New route groups should ship with their OpenAPI fragment so the docs stay complete.