SILENTCHAIN AI™ - Community Edition

---

Note: This is the Community Edition. Commercial and Professional Editions with advanced features are available separately.

🌟 Overview

SILENTCHAIN AI™ - Community Edition is a Burp Suite extension that brings the power of artificial intelligence to web application security testing. Using advanced AI models, SILENTCHAIN performs intelligent passive analysis of HTTP traffic to identify OWASP Top 10 vulnerabilities, security misconfigurations, and potential attack vectors.

Why SILENTCHAIN?

Traditional security scanners rely on predefined signatures and patterns. SILENTCHAIN AI™ goes beyond with:

• 🧠 AI-Powered Analysis: Leverages state-of-the-art language models (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure) for intelligent vulnerability detection
• 🎯 Context-Aware Detection: Understands application logic and business context, not just pattern matching
• ⚡ Real-Time Scanning: Analyzes traffic as it flows through Burp's proxy
• 📊 Professional Reporting: Generates detailed findings with CWE, OWASP mappings, and remediation guidance
• 🔄 Zero False Positives: AI validation reduces noise and focuses on real vulnerabilities
• 🆓 Community Edition: Free passive analysis capabilities

---

✨ Features

Core Capabilities

🔍 Passive AI Analysis

• Real-time traffic analysis through Burp Proxy
• OWASP Top 10 vulnerability detection
• CWE-mapped security findings
• Intelligent confidence scoring

🎨 Professional UI

• Modern, intuitive dashboard
• Live findings panel with severity color-coding
• Task tracking and management
• Integrated console logging

🤖 Multi-AI Support

• Burp AI (default; in-process, zero-config; Burp Suite Professional)
• Ollama (local, free, privacy-focused)
• OpenAI (GPT-4 / GPT-4o)
• Claude (Anthropic)
• Gemini (Google)
• Azure OpenAI / Foundry

📋 Smart Reporting

• Detailed vulnerability descriptions
• Affected parameters identification
• CWE and OWASP mappings
• Remediation recommendations
• Direct links to security resources

🛡️ Data Privacy (DataSanitizer)

• Enabled by default — automatically protects sensitive data before it leaves your machine
• Bidirectional redaction: sensitive values are replaced with [REDACTED_*] placeholders before sending to cloud AI providers, then restored in the response
• Detects and redacts:
  • API keys — OpenAI (sk-), GitHub (ghp_), AWS (AKIA), GitLab (glpat-), Slack (xoxb-)
  • Authorization headers — Bearer tokens, Basic auth
  • Credentials — password/secret/token fields, user:pass@host URIs
  • Session cookies — session IDs, CSRF tokens, JWTs, auth tokens
  • Email addresses
  • IP addresses & hostnames — target infrastructure details
• Skipped entirely for Ollama (local-only, no data leaves your machine)
• Can be toggled off in Settings for advanced users

Vulnerability Detection

SILENTCHAIN AI™ detects a wide range of security issues including:

---

🚀 Quick Start

Prerequisites

• Burp Suite Professional 2025.2+ (recommended — required for the default Burp AI provider) or Burp Suite Community (works with external providers such as Ollama)
• Java 21 runtime (bundled with current Burp releases)
• An AI provider (one of the following):
  • Burp AI (default; zero-config; requires Burp Suite Professional + an active Burp AI subscription)
  • Ollama (free, local, privacy-focused)
  • OpenAI API key
  • Claude (Anthropic) API key
  • Gemini (Google) API key
  • Azure OpenAI / Foundry

Installation

1. Download the extension

   • Grab the latest silentchain-community-edition.jar from GitHub Releases (this link always serves the newest build). Specific versions (silentchain-community-edition-X.Y.Z.jar) are on the Releases page.

2. Load it in Burp Suite

   • Go to Extensions → Installed → Add
   • Set Extension type: Java
   • Select the downloaded .jar and click Next

3. Configure your AI provider

   • Open the SILENTCHAIN Community tab → ⚙ Settings
   • Pick a provider — Burp AI works with no configuration. For an external provider, set the API URL / key / model, click Test Connection, then Save.

4. Start scanning

   • Set your target scope in Burp (Target → Scope)
   • Enable passive analysis in the SILENTCHAIN Community tab (it is OFF by default), then browse the target through Burp's proxy — or right-click any request → Analyze (SILENTCHAIN) for on-demand analysis
   • Findings appear in the SILENTCHAIN Community tab and as native Burp Scanner issues

Requirements

• Cross-platform: Windows, macOS, Linux
• Burp Suite Community or Professional (Professional + AI subscription for the Burp AI provider)
• Java 21 (bundled with current Burp releases)

---

🔧 Configuration

AI Provider Setup

Option 1: Burp AI (Default — zero configuration)

Requires Burp Suite Professional + an active Burp AI subscription. No API URL or key needed — analysis runs in-process through PortSwigger's Burp AI service and consumes Burp AI Credits from your account.

• Provider: Burp AI
• API URL / Key / Model: (not required)

Option 2: Ollama (Recommended for local / private use)

Free, local, no API keys required

1. Install Ollama:

   root@kitploit:~

   # macOS/Linux
   curl -fsSL https://ollama.ai/install.sh | sh
   
   # Windows
   # Download from https://ollama.ai/download
   

2. Pull a model:

   root@kitploit:~

   ollama pull deepseek-r1
   # or
   ollama pull llama3
   

3. Configure SILENTCHAIN:

   • Provider: Ollama
   • API URL: http://localhost:11434
   • Model: deepseek-r1:latest

Option 3: OpenAI

1. Get API key from platform.openai.com

2. Configure SILENTCHAIN:

   • Provider: OpenAI
   • API URL: https://api.openai.com/v1
   • API Key: sk-...
   • Model: gpt-4 or gpt-3.5-turbo

Option 4: Claude (Anthropic)

1. Get API key from console.anthropic.com

2. Configure SILENTCHAIN:

   • Provider: Claude
   • API URL: https://api.anthropic.com/v1
   • API Key: Your Anthropic API key
   • Model: claude-3-5-sonnet-20241022

Option 5: Google Gemini

1. Get API key from makersuite.google.com

2. Configure SILENTCHAIN:

   • Provider: Gemini
   • API URL: https://generativelanguage.googleapis.com/v1
   • API Key: Your Google API key
   • Model: gemini-1.5-pro

Settings Reference

---

📖 Documentation

How It Works

1. Traffic Interception: SILENTCHAIN monitors HTTP requests/responses through Burp Proxy
2. Scope Filtering: Only analyzes in-scope targets (configure in Burp's Target Scope)
3. AI Analysis: Sends request/response data to AI for security analysis
4. Vulnerability Detection: AI identifies security issues based on OWASP Top 10 patterns
5. Finding Generation: Creates detailed reports with severity, confidence, and remediation
6. Deduplication: Prevents duplicate findings for the same URL/parameter combination

Finding Confidence Levels

UI Components

📊 Statistics Panel

• Total Requests: HTTP requests analyzed
• Analyzed: Successfully processed
• Skipped (Duplicate): Prevented redundant analysis
• Findings Created: Total vulnerabilities found
• Errors: Analysis failures

📋 Active Tasks

• Shows currently processing requests
• Status tracking (Queued, Analyzing, Completed)
• Duration timing

🔍 Findings Panel

• All detected vulnerabilities
• Severity-based color coding:
  • 🔴 High - Critical vulnerabilities
  • 🟠 Medium - Important security issues
  • 🟡 Low - Minor vulnerabilities
  • 🔵 Information - Security notes
• Confidence levels
• Discovery timestamps

🖥️ Console

• Real-time logging
• AI connection status
• Analysis progress
• Error messages

---

🎯 Usage Examples

Basic Workflow

1. Set Target Scope

   root@kitploit:~

   Burp → Target → Scope → Add
   Example: https://example.com/*
   

2. Browse Application

   • Configure browser proxy to Burp (127.0.0.1:8080)
   • Navigate through the target application
   • SILENTCHAIN analyzes in the background

3. Review Findings

   • Check SILENTCHAIN → Findings panel
   • Or Target → Issue Activity (integrated with Burp)

Context Menu Analysis

Right-click any request in:

• Proxy History
• Site Map
• Repeater

Select: SILENTCHAIN - Analyze Request

This forces analysis even if the URL was previously scanned.

Manual Verification

1. Select a finding in the Findings panel
2. Review the detailed description
3. Check affected parameters
4. Follow CWE/OWASP links for more information
5. Manually test using Burp Repeater/Intruder

---

🆚 Community vs Professional

⬆️ Upgrade to Professional

SILENTCHAIN Professional adds active verification capabilities:

• 🎯 Phase 2 Verification: Automatically validates findings with exploit payloads
• 🛡️ WAF Detection: Identifies and adapts to web application firewalls
• 📚 Curated Payload Libraries: Battle-tested OWASP payloads
• 🌐 OOB Testing: Detects blind vulnerabilities (SSRF, XXE, etc.)
• 🔄 Burp Intruder Integration: Auto-configures fuzzing attacks
• ⚡ Smart Fuzzing: AI-generated payloads for maximum coverage

See it in action — watch the full SILENTCHAIN Professional demo to see AI-powered active verification, WAF evasion, and automated fuzzing at work.

Contact us for commercial licensing and professional editions: [email protected]

---

🛠️ Troubleshooting

Common Issues

"AI connection test failed"

Solution:

• Check AI provider is running (Ollama: ollama list)
• Verify API URL is correct
• For cloud providers, confirm API key is valid
• Check network connectivity

"No findings detected"

Solution:

• Verify target is in scope (Target → Scope)
• Ensure traffic is flowing through Burp Proxy
• Check Console for errors
• Try manual analysis (right-click → SILENTCHAIN - Analyze Request)

"Extension fails to load"

Solution:

• Confirm the extension type was set to Java when loading the .jar
• Verify Burp Suite is current (2025.2+ for the Burp AI provider) with a Java 21 runtime
• Review Extensions → Installed → (SILENTCHAIN Community) → Errors / Output
• Re-download the .jar if the file may be corrupted

High Memory Usage

Solution:

• Reduce Max Tokens setting (Settings → AI Provider)
• Clear completed tasks regularly
• Use lighter AI models (e.g., llama3 instead of deepseek-r1)

Debug Mode

Enable verbose logging:

1. Settings → Advanced
2. Check Verbose Logging
3. Review Console for detailed output

---

🤝 Contributing

This project does not accept outside contributions. See CONTRIBUTING.md for details.

Reporting Bugs

1. Check existing issues
2. Create a new issue with:
   • Burp Suite version
   • SILENTCHAIN version
   • AI provider/model
   • Steps to reproduce
   • Error messages (from Console)

Feature Requests

Open an issue with tag enhancement:

• Describe the feature
• Explain use case
• Provide examples if possible

---

📄 License

SILENTCHAIN AI™ CE is source-visible but proprietary software. By using this software, you agree to the terms in the LICENSE file.

PortSwigger BApp Store

PortSwigger Ltd. is granted explicit permission to redistribute, host, and bundle this software within Burp Suite and the BApp Store free of charge to users. All other redistribution is prohibited without written permission.

---

⚖️ Responsible Use

Do not use this software for unauthorized access or activities outside systems you own or have explicit permission to test.

Data Handling and Third-Party AI Disclosure

See PRIVACY.md for the full privacy notice, including the per-provider data-residency table and your responsibilities when scanning sensitive targets.

SILENTCHAIN analyzes HTTP requests and responses intercepted by Burp Suite. Depending on the AI provider you select, this data may be transmitted to third-party cloud services.

Which providers see your data

When a cloud AI provider is selected, SILENTCHAIN sends the HTTP request method, URL, headers, body, and response data for each in-scope request to the provider's API for analysis. The built-in DataSanitizer (enabled by default) redacts API keys, credentials, session tokens, and other sensitive patterns before transmission, but it cannot guarantee removal of all sensitive data from request/response bodies.

Regulated data restriction

Do not submit regulated data to cloud AI providers. This includes:

• PHI (Protected Health Information) under HIPAA
• PCI DSS cardholder data (credit card numbers, CVVs, etc.)
• EU personal data subject to GDPR (Art. 13 requires disclosure of sub-processors)
• CCPA-covered personal information (Cal. Civ. Code 1798.100 et seq.)

If your target application processes any of the above data categories, you must use a local AI provider (Ollama) or ensure you have appropriate data processing agreements with the cloud provider and legal authorization to transmit such data.

No telemetry

SILENTCHAIN itself does not collect, store, or transmit any usage data, telemetry, or analytics. All data flows are directly between your Burp Suite instance and your selected AI provider.

Best practices

1. Use Ollama for sensitive or regulated environments (100% local, private)
2. Enable DataSanitizer (on by default) when using cloud providers
3. Review your AI provider's data retention and privacy policies before use
4. Never test production systems without authorization
5. Sanitize findings and logs before sharing externally

---

💬 Support & Community

Get Help

• 📚 Documentation: Documentation
• 🐛 Issues: GitHub Issues
• ✉️ Email: [email protected]

Stay Updated

• ⭐ Star this repository
• 👁️ Watch for updates
• 🐦 X (Twitter): @silentchainai

---

🙏 Acknowledgments

Built by:

• @xer0dayz at @Sn1perSecurity LLC

Built with:

• Burp Suite by PortSwigger
• Ollama for local AI
• OpenAI for GPT models
• Anthropic for Claude
• Google for Gemini

Inspired by the security community's dedication to making the web safer.

---

™️ Trademark Notice

"SILENTCHAIN AI™", "SILENTCHAIN™", and the SILENTCHAIN AI logo are trademarks of SN1PERSECURITY LLC. Unauthorized use is prohibited.

Legal Notices

See NOTICE for third-party trademark attributions.

---