Burp-Suite-collections

BurpSuite related collection project, plugins are mainly non-BApp Store (store)

All localization or use of burpsuite is under the premise that you have configured the Java environment!!! Related tutorial

Latest version (after 202212) activation refer to this project solve it yourself, this project does not provide

New burp (after 202209) activation refer to scz's method: address

This project is only for burpsuite plugin related learning and research use! No longer provides cracked versions! The project has been submitted to GitHub's DMCA by burp official, cracked related files have been deleted, if needed please go to blog to download the latest burpsuite_pro_v2020.11.3.jar&BurpSuiteLoader.jar download

Make it into an APP under Mac and put it in the dock for one-click launch

Use github action to package the latest burp plugins

Penetration Testing Interview Questions 2019 Edition

Plugin directory plugins introduction:

• AuthKit The first multi-dimensional, UI/UX-friendly Burp suite privilege escalation vulnerability detection plugin, through multi-identity replay and multi-dimensional response comparison, assists in discovering unauthorized access, horizontal privilege escalation, vertical privilege escalation and BOLA / IDOR risks, reducing repeated packet sending and manual comparison. Source
• BurpAPISecuritySuite A professional-grade API security testing extension that integrates reconnaissance, analysis, fuzzing, asset management, external tool linkage and AI automation. Source
• AuthMatrix A plugin for detecting IDOR privilege escalation vulnerabilities in HTTP requests. Source
• BurpHistory2Pcap A plugin that exports burp suite's HTTP history requests and responses into PCAP packets containing complete TCP sessions. Source
• mcp-server --- An extension officially released by PortSwigger, used to enable Burp Suite to directly interact bidirectionally with AI clients (such as Claude Desktop). It implements the Model Context Protocol (MCP), allowing AI to control Burp's tools like a "remote assistant", such as Repeater, Proxy, Organizer, etc. Source
• BurpSuiteSharpenerEx --- An extension specifically designed to enhance the Burp Suite experience, through a large number of UI and interaction improvements, making core tools such as Repeater, Intruder, Proxy more usable and efficient. Source
• TokenTwin-Checker --- An automated authorization testing extension developed specifically for Burp Suite, used to quickly discover BAC (Broken Access Control), IDOR (Insecure Direct Object Reference) and horizontal privilege escalation vulnerabilities. Its core function is: allowing multiple different users' identities (Cookie / Token) to automatically replay the same request against each other, thereby detecting whether unauthorized access exists. Source
• BurpMCP-Ultra --- A high-performance MCP extension framework built for Burp Suite, a BurpSuite enhancement plugin used to integrate multi-model AI, automated analysis and intelligent assisted operations in penetration testing. Source
• burp_history --- A Burp Suite historical traffic recording and analysis plugin that integrates HTTP traffic monitoring, management and team sharing collaboration Source
• DouSql --- A SQL injection detection plugin based on secondary development of Xia Sql Source
• burp_variables --- Allows you to define and use variables in Burp tools Source
• SMS_Bomb_Fuzzer --- Burp suite SMS bombing auxiliary bypass plugin Source
• APIKit --- An integrated BurpSuite vulnerability detection plugin Source
• TsojanScan --- An integrated BurpSuite vulnerability detection plugin Source
• CloudX --- A rule-based encryption/decryption and signature-breaking tool Source
• FastjsonScan4Burp --- A fastjson vulnerability detection plugin based on burp passive scanning, which can perform payload testing against parameters or request bodies containing json in data packets. Designed to help security personnel more conveniently discover, detect and deeply exploit fastjson vulnerabilities. Currently implements fastjson detection, version detection, dependency detection, as well as out-of-network and non-out-of-network exploitation and simple bypass waf functionality. Source
• CaptchaDos --- Burpsuite captcha DOS attack plugin Source
• BucketVulTools --- Burpsuite storage bucket misconfiguration vulnerability detection plugin Source
• Auto-SSRF --- SSRF vulnerability automatic detection plugin based on BurpSuite's new MontoyaAPI Source
• AutoRepeater --- Automated discovery of SSRF, Redirect, Sqli vulnerabilities, custom matching parameters Source
• DetSql --- Quickly detect and mark requests that may contain SQL injection, improving testing efficiency Source
• SqlScout --- A SQL injection auxiliary detection and parameter mutation plugin oriented toward Burp's daily workflow, focusing on "quick screening + manual review"; compared to DetSql, it emphasizes complex parameter structure handling and strategy controllability Source
• AutorizePro --- A privilege escalation detection Burp plugin, by adding an AI analysis module && further optimizing detection logic, greatly reducing false positive rates and improving privilege escalation vulnerability detection efficiency Source
• Zack-AI-Scanner --- An automated Web vulnerability scanning Burp plugin based on large language models, supporting AI intelligent scanning, vulnerability verification and report export Source
• nowafpls --- Insert junk characters to bypass waf Source
• gatherBurp --- fastjson, privilege bypass, unauthorized, sql injection, multi-level routing, log4j scanning as well as generating random strings of specified kb size + subdomains + proxy pool Source
• BurpFingerPrint --- Integrates the Ehole fingerprint library and performs common OA weak password brute-forcing plugin Source
• BurpAPIFinder --- API, sensitive information comprehensive extraction plugin Source