Burp Extensions and Automation

What the BApp Store Provides

The Burp Suite BApp Store is a marketplace of extensions that add functionality to Burp. Extensions are written in Java, Python (Jython), or Ruby (JRuby) and integrate directly into Burp's interface. They can add new scan checks, modify requests/responses, add UI panels, or integrate with external tools.

Installing Extensions

1. Open Burp and go to Extender > BApp Store
2. Browse or search for extensions
3. Click Install — Burp downloads and loads the extension immediately
4. Installed extensions appear in the Extender > Extensions tab

Essential Extensions for Web Testing

JWT Editor — Parses and modifies JWT tokens directly in Burp. You can edit claims, sign with custom keys, and test for algorithm confusion attacks. Essential for testing JWT-based authentication.

Autorize — Tests authorization automatically. You define access levels (e.g., admin user, regular user) and Autorize replays each request with different session cookies to detect authorization bypasses.

Param Miner — Discovers hidden parameters by fuzzing headers, cookies, and query strings. Hidden parameters often reveal debug features, internal APIs, or undocumented functionality.

Logger++ — Advanced logging and filtering. Logs all Burp traffic to a searchable database with powerful filter expressions. Essential for analyzing large amounts of traffic.

Turbo Intruder — High-performance fuzzing engine. Sends thousands of requests per second for brute-force attacks that would be too slow with standard Intruder.

Backslash Powered Scanner — Fuzzes parameter values with specially crafted payloads designed to trigger error messages that reveal the backend technology and version.

Managing Extensions

In Extender > Extensions, you can:

• Enable/disable extensions
• Configure extension-specific options
• View extension output and errors
• Uninstall extensions

Extensions can slow down Burp or cause instability. If Burp becomes unresponsive, disable extensions one by one to identify the culprit.

Why Custom Scan Checks Matter

Burp's built-in scanner detects common vulnerabilities (SQLi, XSS, etc.) but cannot find application-specific logic flaws. For example, if your application has a pricing calculation bug where negative quantities result in account credit, no built-in scanner will find that. Custom scan checks let you test for these unique vulnerabilities.

Extension Development Basics

Burp extensions implement specific interfaces:

• IScannerCheck — For custom passive and active scan checks
• IHttpListener — For processing every HTTP request/response
• IContextMenuFactory — For adding right-click menu items
• ITab — For adding custom tabs to Burp's UI

Example: Custom Active Scan Check in Python (Jython)

from burp import IScannerCheck
from burp import IScanIssue
import array

class BurpExtender(IScannerCheck):
    def doActiveScan(self, baseRequestResponse, insertionPoint):
        # Test for negative quantity in pricing
        payload = b"-1"
        checkRequest = insertionPoint.buildRequest(payload)
        checkResponse = self._callbacks.makeHttpRequest(
            baseRequestResponse.getHttpService(), checkRequest
        )
        
        response = checkResponse.getResponse()
        responseStr = self._helpers.bytesToString(response)
        
        if b"credit" in responseStr.lower() or b"refund" in responseStr.lower():
            return [CustomScanIssue(
                baseRequestResponse.getHttpService(),
                self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
                [checkResponse],
                "Negative Quantity Exploit",
                "The application accepts negative quantities and applies account credit.",
                "High"
            )]
        return None

Loading Custom Extensions

1. Go to Extender > Extensions > Add
2. Select extension type: Python or Java
3. Point to your .py or .jar file
4. Burp loads the extension and displays any errors in the Output tab

Practical Use Cases for Custom Checks

• Business logic testing — Test for pricing manipulation, coupon abuse, or workflow bypass
• Custom authentication — Test for flaws in proprietary authentication schemes
• API-specific vulnerabilities — Test for GraphQL injection, REST API versioning issues
• Data validation — Test for application-specific input validation flaws

Debugging Extensions

Use print() statements in Python extensions or System.out.println() in Java. Output appears in Extender > Extensions > Output. For more complex debugging, use Burp's callbacks.printError() for error messages that appear in the Errors tab.

Burp's Automation Capabilities

Burp Suite Enterprise and Burp Suite Professional (with extensions) support automated scanning workflows. These allow you to:

• Schedule recurring scans against staging environments
• Run authenticated scans with predefined session handling
• Integrate with CI/CD pipelines for continuous security testing
• Generate reports automatically after each scan

Burp REST API

Burp Suite Enterprise exposes a REST API that lets you control Burp programmatically:

# Start a scan
curl -X POST "https://burp.example.com/api/v1/scans" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"urls": ["https://staging.example.com"], "scope": {"include": [{"prefix": "https://staging.example.com"}]}}'

# Get scan status
curl "https://burp.example.com/api/v1/scans/$SCAN_ID" \
  -H "Authorization: Bearer $API_KEY"

# Get scan results
curl "https://burp.example.com/api/v1/scans/$SCAN_ID/issues" \
  -H "Authorization: Bearer $API_KEY"

CI/CD Integration

Integrate Burp scans into your deployment pipeline:

# Example GitHub Actions workflow
- name: Run Burp Scan
  run: |
    curl -X POST "$BURP_URL/api/v1/scans" \
      -H "Authorization: Bearer $BURP_API_KEY" \
      -d '{"urls": ["https://staging.example.com"]}'
    # Wait for scan completion
    # Fail build if high-severity issues found

Scheduled Scans

In Burp Suite Enterprise, configure scheduled scans:

1. Go to Scans > Scheduled scans
2. Define the target URL and scan configuration
3. Set the schedule (daily, weekly, custom cron)
4. Configure notification emails for completed scans

Scheduled scans run automatically against staging environments, catching regressions before they reach production.

Reporting Automation

Burp can generate reports in multiple formats (HTML, XML, JSON). Automate report generation:

• After each scheduled scan, generate a PDF report
• Email the report to the security team
• Upload findings to a vulnerability management platform (e.g., DefectDojo, Jira)

Practical Tip: Scan Configuration as Code

Store your Burp scan configurations in version control:

{
  "scan_name": "Staging Weekly Scan",
  "urls": ["https://staging.example.com"],
  "scope": {
    "include": [{"prefix": "https://staging.example.com"}]
  },
  "scan_type": "active",
  "max_crawl_depth": 10,
  "session_handling": {
    "login_url": "https://staging.example.com/login",
    "credentials": {"username": "testuser", "password": "testpass"}
  }
}

This makes scan configurations reproducible and reviewable in pull requests.