waf-fu
confused-binary/waf-fuTerminal UI for browsing and replaying AWS WAF v2 logs from CloudWatch, S3, and the sampling API, with YAML filtering, auth detection, and…
cloud-securitydefensive-toolsincident-response+6
confused-binary/waf-fuTerminal UI for browsing and replaying AWS WAF v2 logs from CloudWatch, S3, and the sampling API, with YAML filtering, auth detection, and…
overspace-labs/haeModular Burp Suite extension for fine-grained highlighting and extraction of sensitive data from HTTP and WebSocket traffic, enabling efficient…
evkir/phantom-gridFree Burp Collaborator alternative- OOB interaction capture (HTTP/HTTPS/DNS) with SQLite & exfil reassembly
d3mondev/burp-vps-proxyThis Burp Suite extension allows for the automatic creation and deletion of an upstream SOCKS5 proxy on popular cloud services.
hoodoer/colonelclusteredA Java Burp Plugin that performs text clustering on responses to identify outliers/groups based on the actual content of the server responses, say…
irsdl/burpsuitesharpenerexThis extension enhances Burp Suite by adding several UI and functional features, making it more user-friendly.
t0xodile-swig/http3-adapterBurp Suite extension that intercepts requests and sends them over HTTP/3, converting responses back for Burp, with support for kettled requests and…
larrypeseckis/burp-cc-bridgeREST API automation for Burp Suite Community Edition. Drop-in Java extension exposing send/repeat/history endpoints over a local HTTP API.
projectdiscovery/nuclei-burp-pluginBurp Suite plugin for generating and executing Nuclei vulnerability templates directly from HTTP requests and responses, with YAML auto-complete and…
d0ge/websocketturbointruderBurp Suite extension for fuzzing WebSocket messages with custom Python code, supporting multiple engines, HTTP middleware routing, and response…
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
projectdiscovery/httpxFast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…
unkn0wn-root/restermTerminal API client for HTTP, GraphQL, gRPC, WebSocket and SSE. Plain .http files you can diff and version, with scripted tests, workflows, mocks,…
nccgroup/autorepeaterAutomated HTTP Request Repeating With Burp Suite
intelligencex/sdkSDK for querying the Intelligence X search engine and data archive, supporting selectors like email, domain, IP, and phone. Includes API wrappers in…
portswigger/active-scan-plus-plusBurp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, code injection, and known CVEs like…
syhunt/sandcatAn open-source, pentest and developer-oriented web browser, using the power of Lua
portswigger/burp-extensions-montoya-api-examplesSample Burp Suite extensions demonstrating the Montoya API, covering HTTP and proxy handlers, custom scan checks, Intruder payloads, WebSocket…