Penetration Testing Interview Questions 2019 Edition

Plugin Directory plugins Introduction:

• BurpMCP-Ultra --- A high-performance MCP extension framework for Burp Suite, an enhanced BurpSuite plugin for integrating multi-model AI, automated analysis, and intelligent assistant operations during penetration testing. Source

• burp_history --- A Burp Suite historical traffic recording and analysis plugin that integrates HTTP traffic monitoring, management, and team sharing collaboration Source

• DouSql --- A SQL injection detection plugin based on secondary development of Xia Sql Source

• burp_variables --- Allows you to define and use variables in Burp tools Source

• SMS_Bomb_Fuzzer --- Burp suite SMS bomb bypass plugin Source

• APIKit --- An integrated BurpSuite vulnerability detection plugin Source

• TsojanScan --- An integrated BurpSuite vulnerability detection plugin Source

• CloudX --- A rule-based encryption/decryption and signature breaking tool Source

• FastjsonScan4Burp --- A Burp passive scan based fastjson vulnerability detection plugin that performs payload testing on JSON parameters or request bodies in data packets. It aims to help security personnel more conveniently discover, detect, and exploit fastjson vulnerabilities. Currently it implements fastjson detection, version detection, dependency detection, out-of-band and in-band exploitation, and simple WAF bypass functionality. Source

• CaptchaDos --- Burpsuite CAPTCHA DOS attack plugin Source

• BucketVulTools --- Burpsuite bucket misconfiguration vulnerability detection plugin Source

• Auto-SSRF --- An SSRF vulnerability automatic detection plugin based on BurpSuite's new MontoyaAPI Source

• AutoRepeater --- Automated mining of SSRF, Redirect, SQLi vulnerabilities, with custom matching parameters Source

• DetSql --- Quickly detect and mark requests that may contain SQL injection, improving test efficiency Source

• SqlScout --- A SQL injection auxiliary detection and parameter mutation plugin for Burp daily workflow, focusing on "quick screening + manual review"; compared to DetSql, it emphasizes complex parameter structure handling and policy controllability Source

• AutorizePro --- An authorization bypass detection Burp plugin, adding AI analysis module && further optimizing detection logic to significantly reduce false positive rates and improve privilege escalation vulnerability detection efficiency Source

• Zack-AI-Scanner --- An automated web vulnerability scanning Burp plugin based on large language models, supporting AI smart scanning, vulnerability verification, and report export Source

• nowafpls --- Insert garbage characters to bypass WAF Source

• gatherBurp --- Fastjson, permission bypass, unauthorized access, SQL injection, multi-level routing, log4j scanning, and generating specified KB-sized random strings + subdomain + proxy pool Source

• BurpFingerPrint --- Integrated Ehole fingerprint library and common OA weak password brute force plugin Source

• BurpAPIFinder --- API and sensitive information comprehensive extraction plugin Source

• Galaxy --- Efficiently view, edit, and scan plaintext packets in scenarios where HTTP request & response are fully encrypted and signed Source

• BurpAppletPentester --- WeChat mini program Wx_SessionKey encryption/decryption plugin Source

• Burpy --- Python-based front-end encryption/decryption solution Source

• interactsh-collaborator --- Burp plugin for Interact.sh reverse chain platform Source

• burpsuite_hack --- Passive proxy scanning plugin that can detect SQL injection and SSRF vulnerabilities Source

• BypassPro --- Burpsuite plugin for automated permission bypass Source | BypassPro modified upgraded version

• BypassFuzzer-Burp --- A Burpsuite plugin for testing authorization bypass vulnerabilities (401/403 bypass) and URL validation bypass Source

• burp-vps-proxy --- A plugin that automatically creates and deletes an upstream SOCKS5 proxy on most cloud services and applies it Source

• CustomCrypto --- Burp custom encryption/decryption plugin Source

• npscrack --- npscrack: Blue team tool, traceability countermeasure, NPS vulnerability exploitation, NPS exp, NPS poc, one-click exploitation BurpSuite plugin Source

• OneScan --- A recursive directory scanning BurpSuite plugin Source

• OutLook --- An OutLook information collection tool that automatically crawls all contact information after logging into an Outlook account Source

• passive-scan-client-plus --- Maintenance branch of passive-scan-client Source

• BpScan --- A Burp passive vulnerability scanning plugin for assisting penetration test engineers in daily penetration testing (SpringSpiderScan, Log4jScan, and FastJsonScan) Source

• BurpCRLFScan --- A CRLF injection Burp passive scanning plugin written in Java Source

• JsonDetect --- A Burp plugin that supports passive scanning of JSON and identifies corresponding JSON dependency libraries based on characteristics of different JSON libraries Source

• autoDecoder --- Customizable data packet processing (suitable for encryption/decryption, brute force, etc.), similar to mitmproxy's Burp plugin Source

• burp-text4shell --- Burp plugin for CVE-2022-42889: Text4Shell vulnerability scan Source

• sweetPotato --- A plugin for automatically recursively discovering domain assets of interest and additional traffic detection in BurpSuite Source

• xia_Liao --- A BurpSuite plugin for quickly generating names, phone numbers, ID numbers, unified social credit codes, organization codes, bank card numbers, and various web language hello world outputs Source

• base64encode --- A BurpSuite POST data packet base64 encoding plugin Source

• HackTools --- A Burp plugin supporting encoding, encryption/decryption, antivirus software query, and text processing Source

• RouteVulScan --- A Burp plugin for recursive passive detection of vulnerable paths Source

• fastjson-exp --- Fastjson exploitation Burp plugin. Supports out-of-band JNDI exploitation detection, in-band Tomcat/Spring echo, Godzilla memory shell, echo chains for DHCP, iBatis, c3p0, memory shell supports Tomcat89 Source

• burp-awesome-tls --- burp-awesome-tls: Fix Burp Suite's terrible TLS stack and fake any browser fingerprint Source

• JustC2file --- Malleable C2 Profile generator; select request via Burp proxy to generate Cobalt Strike profile file (CSprofile) Source

• SpringScan --- Spring Core RCE series detection Source

• TongWebEJBScan-Burp --- A Burp passive scanning plugin for TongWeb application server EJB deserialization vulnerability Source

• captcha-killer-modified --- Modified version of captcha-killer, mainly used for CAPTCHA brute force, compatible with new Burpsuite, supports dddocr invocation Source

• BurpFastJsonScan --- BurpFastJsonScan, a passive FastJson detection plugin based on BurpSuite Source

• xia_sql --- SQL injection detection: append a single quote, two single quotes after each parameter, a simple injection judging plugin Source

• burpFakeIP --- A Burp Suite plugin for testing with forged IP addresses when server configuration is erroneous Source

• Log4j-check --- Another Burp plugin for passive scanning to detect log4j vulnerabilities Source

• Log4j2Scan --- A Burp plugin for passive detection of log4j vulnerabilities Source

• TProxer --- A Python-written Burp plugin for automated SSRF-based reverse proxy directory detection Source

• CaA --- A plugin that collects key parameters such as Burp traffic parameters, paths, etc., stores them in a database to assist analysis or direct invocation Source

• BurpCrypto --- BurpCrypto supports multiple encryption algorithms for brute-forcing front-end encryption, supporting direct invocation of JS encryption methods without third-party components Source

• BurpBountyPlus --- BurpBountyPlus adds right-click menu functionality based on BurpBounty, supports vulnerability scanning and fuzzing on a single data packet's single parameter, bridging the last mile of penetration testing and improving efficiency Source

• BurpExtractor --- Extract parameters from requests and responses for brute force, replay, etc. Source

• burp-cph --- Also extracts parameters from requests and responses for brute force, replay Source

• sql-sup --- Implements parameter overflow, garbage data, dictionary Cartesian product Source

• BurpJSLinkFinder --- Extract hidden interface information such as domains and URLs from JavaScript Source

• NEW_xp_CAPTCHA --- Burp CAPTCHA recognition brute force Source

• domain_hunter_pro --- Advanced version of domain_hunter, essential for SRC mining and HW points Source

• charset_0.4.py --- A Burp plugin that bypasses WAF via character set encoding Source

• struts_ext_v2.jar --- Supports calling to check Struts2 series vulnerabilities in BurpSuite plugin form Download-Source

• domain_hunter_pro -- Internal version of domain_hunter, still from brother bit4woo Source

• JC-AntiToken --- A simple anti-replay bypass Burp plugin written in Python that automatically requests the next token from a specific source during a request. Source

• BurpCustomizer --- New burp skin switching plugin, comes with dozens of skins (only supports Burp version 2020.12 and above), simple to use: load the plugin, switch skins in the Customizer Tab Source

• BurpSuite_403Bypasser --- A plugin written in Python for testing 403 bypass. Source

• Burp-Non-HTTP-Extension --- A plugin for capturing non-HTTP traffic in Burpsuite. Source

• burp-unauth-checker --- A Burp plugin developed in Python for automated unauthorized vulnerability checking. Source

• Unexpected.informationv --- A plugin for marking sensitive information, JS interfaces, and special fields in request packets to prevent oversight of data packets. Built-in eight common sensitive information types (ID card info, phone number info, IP info, email info, JS file API interface paths, special fields (password, method: "post"...), bidirectional detection, highlighting, etc.), good experience. Source

• HaE --- An information highlighting and extraction plugin developed in Java, better than two previously introduced ones (BurpSuite-Xkeys and IntelligentAnalysis-SSTVINFO) (requires manual writing of detection rules, only email detection rule built-in). Source

• BurpShiroPassiveScan --- A passive Shiro detection plugin based on BurpSuite, currently with two major functions: 1. Shiro framework fingerprint detection 2. Shiro encryption key detection Source

• shiro-check --- Shiro deserialization echo exploitation check Burp plugin, Source project download

• FastjsonScan --- A Burp plugin for detecting Fastjson deserialization developed by Master Axin, FastjsonScan.jar download, Source code

• fastjsonScan --- Fastjson vulnerability Burp plugin, detects fastjson<1.2.68 based on dnslog, fastjson<=1.2.24 and 1.2.33<=fastjson<=1.2.47 out-of-band detection and TomcatEcho, SpringEcho echo schemes Source

• BurpSuite-Extender-fastjson --- A Python plugin for automatic detection of fastjson RCE, can detect 1.2.24 and 1.2.47. If a vulnerability exists, it automatically marks the traffic and outputs content in output. Source

• BurpSuite-Xkeys --- A Python-written plugin for extracting sensitive information from web pages by a foreign master, similar to the IntelligentAnalysis-SSTVINFO plugin recommended earlier. Welcome to experience. Download and detailed description

• passive-scan-client-and-sendto --- A Burp passive scan automatic forwarding and manual resend plugin, Click to download, Detailed description

• shiroPoc-0.5-SNAPSHOT-jar-with-dependencies.jar --- A Shiro echo Burp plugin (supports Burp passive scanning function), Click to download, Detailed description and source

• Burp_AES_Plugin --- A plugin for brute-forcing AES encryption CBC mode. Before use, modify the key and iv values in src/main/java/burp/BurpExtender.java, then compile with mvn install. Source

• IntelligentAnalysis-SSTVINFO --- A Burp plugin developed in Python for discovering sensitive information contained in responses. SSTVINFO Source Modified version with email recognition and IP address correction in plugin directory Download.

• burpJsEncrypter-0.1-jar-with-dependencies.jar --- A more user-friendly Burp plugin for solving front-end encryption problems. Source

• captcha-killer.0.1.1.jar --- Burp CAPTCHA recognition interface invocation plugin. Source

• burp-requests-v0.2.4.jar --- Convert Burp requests directly into Python requests library format code. Source

• J2EEScan-2.0.0-beta.2-jar-with-dependencies.jar --- A very useful plugin for scanning J2EE programs. The store version is old. The author updated it on GitHub a few days ago but not on the store, so it's included here. Source, not compiled, I compiled it on behalf, with dependencies, import and use.
  
  

• WooyunSearch-1.0-SNAPSHOT-jar-with-dependencies.jar --- Extract payloads from Wooyun to assist penetration, Detailed description

• httpsmuggler.jar --- A plugin to assist bypassing WAF, Detailed description

• http-request-smuggler-all.jar --- HTTP smuggling attack detection plugin, related article: A smuggling request learning

• sqlmap4burp++.0.2.jar --- Multi-platform Burp plugin for collaborative sqlmap without external dependencies. Easy to use: import intercepted requests or replay in Burp to send directly to sqlmap4burp interface. First time need to set sqlmap.py file location. See Brother Piaoxue - c0ny1 source for details.

• passive-scan-client-0.1-jar-with-dependencies.jar --- Burp passive scan traffic forwarding plugin, for example, use with Chaitin's XRAY for passive scanning. Borrowing a phrase from the group brother: Hang up and wait for holes. Detailed description, demo gif:

• domain_hunter-1.4.jar --- A plugin that uses Burp to collect domains of the entire enterprise/organization (not just a single primary domain). Detailed description

• reCAPTCHA.v0.9.jar --- Burpsuite Intruder module CAPTCHA automatic recognition plugin for brute force, detailed usage: Instructions

• knife-1.8-jar-with-dependencies.jar --- A Burpsuite enhancement plugin developed by bit4, mainly adding right-click menu functions (including hackbar++ plugin function), and adding Tab areas, such as U2C (convert Unicode characters to Chinese, e.g., \u4e2d\u6587-->中文), very practical, can improve efficiency during testing, effect shown:

• LoggerPlusPlus.jar --- As the name suggests, a logging plugin for Burpsuite, but enhanced. If you are not satisfied with Burpsuite's built-in logging, give it a try! just join it! Detailed introduction at Project URL I currently added Version v3.19.2 release.

• HackBar.jar --- Those who do penetration testing early know the old Firefox HackBar plugin, right? This Burpsuite plugin has similar functionality. See project source for details — HackBar GIF below:

• LFI scanner checks.jar --- Developed by Chinese lufei for Burp lightweight scanner to detect LFI (Local File Include) vulnerabilities. Related articles can be found on freebuf or see the saved PDF

• jsEncrypter.0.3 --- Use phantomjs to call front-end encryption function to encrypt data, convenient for fuzzing encrypted data input points Source

• burp-vulners-scanner-1.2.jar --- Burp scans requests passing through Burp for vulnerabilities based on the vulnerability library provided by Vulners.com Source

• bypasswaf.jar --- As the name suggests, bypass some WAFs Source Introduction article

• chunked-coding-converter.0.2.1.jar --- Latest version by Chinese c0ny1, Burp chunked output, also a WAF countermeasure plugin Source

• sqlmap.jar --- Integrate local sqlmap for injection testing. Of course, Burp plugin store also has a sqli-py (URL: https://github.com/portswigger/sqli-py) that can be installed directly, not described... Recommend using sqlmap4burp-plus-plus above, better effect!

Added Translation version of awesome-burp-extensions in plugins directory