Burp Suite

---
name: burp-suite
description: "Expert agent for Burp Suite Professional, Enterprise, and Community. Covers proxy interception, Scanner, Intruder, Repeater, BApp extensions, BCheck custom checks, Bambda filters, REST API, and CI/CD DAST automation. WHEN: \"Burp Suite\", \"Burp Pro\", \"Burp Enterprise\", \"BApp Store\", \"BCheck\", \"Bambda\", \"Intruder\", \"Repeater\", \"Burp proxy\", \"Burp scanner\", \"Burp DAST\", \"burp collaborator\"."
license: MIT
---

# Burp Suite

This skill covers Burp Suite across all editions: Community (free), Professional (manual pen testing), and Enterprise (automated DAST). It covers the full toolset: Proxy, Scanner, Intruder, Repeater, Comparer, Sequencer, BApp extensions, BCheck, and Bambda.

## How to Approach Tasks

1. **Identify the edition:**
   - **Community:** Free, limited Scanner, manual tools available
   - **Professional:** Full manual testing toolkit, active Scanner, BApp Store
   - **Enterprise:** Automated CI/CD DAST, scheduled scans, centralized management
2. **Identify the task type:**
   - **Manual testing:** Proxy setup, Repeater, Intruder, manual exploration
   - **Automated scanning:** Scanner configuration, CI/CD integration
   - **Extension development:** BCheck custom checks, BApp authoring
   - **Architecture/internals:** Load `references/architecture.md`
3. **Consider the target:** Web app, API (REST/GraphQL/gRPC), mobile app backend.

## Burp Suite Professional — Manual Testing

### Proxy Setup

Burp Proxy intercepts all HTTP/S traffic between browser and application.

**Initial setup:**
1. Launch Burp Suite → Proxy → Proxy Settings
2. Default listener: `127.0.0.1:8080`
3. Configure browser to use `127.0.0.1:8080` as HTTP/S proxy
4. Install Burp CA certificate (navigate to `http://burp` while proxying to download)
5. Import CA cert into browser/OS certificate store

**Upstream proxy (corporate networks):**
Settings → Network → Connections → Upstream Proxy → Add rule for `*`

**Automatic scope management:**
```
Target → Scope → Use advanced scope control
Add: https://app.example.com    # Include
Add: https://cdn.example.com   # Exclude
```

**Proxy intercept:**
- Intercept On: inspect/modify individual requests before they reach server
- Intercept Off: traffic flows through transparently to HTTP history
- Forward/Drop individual requests
- Right-click → Send to Repeater/Intruder/Scanner/Comparer

### Scanner

The Scanner (Professional and Enterprise) performs active vulnerability detection.

**Scan types:**

| Type | Description | Use |
|---|---|---|
| Passive scan | Analyze existing traffic, no new requests | Continuous background analysis |
| Active scan | Send attack payloads | Explicit scan initiation |
| Crawl | Discover application content | Before active scan |
| Audit | Vulnerability testing only | Against pre-crawled scope |

**Starting a scan:**
```
Dashboard → New Scan
  Type: Crawl and Audit (or Audit only if site already mapped)
  URLs: https://app.example.com
  Scope: Include only https://app.example.com
  Crawl settings: Max links to follow, login sequence
  Audit settings: Issue types to check, insertion points
```

**Audit issue types:** Configure what Burp Scanner checks:
- SQL injection (all DB types)
- Cross-site scripting (reflected, stored, DOM)
- OS command injection
- Path traversal
- XML injection / XXE
- SSRF
- CSRF
- Clickjacking
- Information disclosure
- TLS/SSL issues

**Scan configuration profiles:**
Built-in profiles:
- `Crawl strategy - fastest` — Quick coverage
- `Crawl strategy - most complete` — Maximum coverage
- `Audit checks - all issues` — Full vulnerability testing
- `Audit checks - critical issues only` — Fast, high-severity only
- `Minimize false positives` — Conservative, less noise

Save custom scan configurations for repeatable use across projects.

### Repeater

Manual request editor for precise testing.

**Workflow:**
1. Capture request in Proxy history
2. Right-click → Send to Repeater (Ctrl+R)
3. Modify request parameters, headers, body
4. Send (Ctrl+Enter) and analyze response
5. Use history (◄►) to compare responses

**Key techniques:**
- Manually test injection points (change one parameter at a time)
- Test authorization by swapping session tokens
- Test IDOR by incrementing/changing resource IDs
- Observe timing differences (blind injection, SSRF confirmation)
- Use Render tab to visualize HTML responses

**Repeater groups:** Organize related requests into tabs with color coding. Useful for multi-step workflows.

### Intruder

Automated payload delivery for fuzzing, brute forcing, and enumeration.

**Attack types:**

| Type | Description | Use Case |
|---|---|---|
| Sniper | One payload position, one list | Simple parameter fuzzing |
| Battering Ram | Same payload to all positions | Username = password |
| Pitchfork | Parallel iteration of multiple lists | Username/password pairs |
| Cluster Bomb | Cartesian product of lists | Enumerate combinations |

**Payload types:**
- Simple list (upload wordlist)
- Character sets (brute force)
- Numbers (sequential IDs)
- Dates
- Usernames/passwords (built-in lists)
- Null payloads (repeat request N times)
- Extension-generated (custom generators)

**Practical Intruder workflow:**
```
1. Send request to Intruder
2. Clear § markers (Clear §)
3. Add payload positions around target parameter(s) (Add §)
4. Select attack type
5. Load/define payloads
6. Configure grep-match to identify interesting responses
7. Start attack
8. Sort by Status code, Length, or Grep match to find anomalies
```

**Note:** Intruder is rate-limited in Community edition. Turbo Intruder BApp provides unlimited speed.

### Sequencer

Analyzes randomness/entropy of tokens (session IDs, CSRF tokens, password reset links).

**Workflow:**
1. Capture a request that generates a token
2. Right-click → Send to Sequencer
3. Mark the token in response → Start live capture
4. Capture 100+ samples (200+ for reliable results)
5. Analyze → View results

**Interpreting results:**
- Effective key space: should be >64 bits for session tokens
- FIPS test results: each randomness test (frequency, runs, FFT, etc.) should pass
- Character distribution: should be uniform
- Predictable patterns: date-based, incrementing sequences

### Comparer

Side-by-side diff of requests or responses.

**Use cases:**
- Compare authenticated vs. unauthenticated responses
- Compare responses with/without a specific payload
- Compare different user role responses (BOLA testing)
- Identify subtle changes in error messages

### BApp Store (Extensions)

Extensions that add functionality to Burp Suite. Available through BApp Store in Extender → BApp Store.

**Security testing essentials:**

| Extension | Purpose |
|---|---|
| Active Scan++ | Additional active scan checks |
| Param Miner | Discover hidden parameters |
| Autorize | Automated authorization testing (IDOR detection) |
| Turbo Intruder | High-speed, scriptable Intruder replacement |
| Logger++ | Enhanced logging and filtering |
| JSON Web Tokens (JWT Editor) | JWT decoding, modification, and attacks |
| HTTP Mock Service | Mock external services during testing |
| InQL | GraphQL introspection and scanning |
| Retire.js | Identify outdated JavaScript libraries |
| GAP | Gather, Analyze, and Parse — enumerate attack surface |
| Hackvertor | Encoding/decoding transformations |
| Collaborator Everywhere | Inject Burp Collaborator into all requests |

**BApp development:** Extensions can be written in Java, Python (Jython), or Ruby (JRuby). Use the Burp Extender API.

### BCheck (Custom Scan Checks)

BCheck is a scripting language for writing custom active scan checks, introduced in Burp Suite 2022.

**BCheck syntax:**

```
# Check for debug endpoint exposure
metadata:
    language: v1-beta
    name: "Debug endpoint check"
    description: "Detects exposed /debug and /console endpoints"
    author: "Security Team"
    tags: "debug", "information disclosure"

given host then
    send request called check:
        method: "GET"
        path: "/debug"
    
    if {check.response.status_code} is "200" then
        report issue:
            severity: high
            confidence: tentative
            detail: "Debug endpoint is accessible at /debug"
            remediation: "Restrict access to debug endpoints in production"
    end if
end
```

**BCheck capabilities:**
- Make arbitrary HTTP requests
- Reference original request/response
- String matching, regex matching in responses
- Multi-step checks (send request A, use its response in request B)
- Parametric checks (vary payloads)

**Running BCheck:**
Settings → Extensions → BCheck → Add BCheck scripts
They run as part of the active scan.

### Bambda (Java Lambda Filters)

Bambda allows writing Java lambda expressions as filters in Burp Suite (2023+). Used in:
- HTTP history filter
- Proxy intercept rules
- Match/replace rules

**Example Bambda — filter requests with JSON body containing "password":**
```java
// HTTP history filter
if (!requestResponse.request().hasHeader("Content-Type")) return false;
var contentType = requestResponse.request().headerValue("Content-Type");
if (!contentType.contains("application/json")) return false;
var body = requestResponse.request().bodyToString();
return body.contains("password");
```

**Example — intercept and modify requests to test IDOR:**
```java
// Proxy intercept condition: match requests with numeric ID in path
var path = requestResponse.request().path();
return path.matches(".*/api/users/\\d+.*");
```

---

## Burp Suite Enterprise — Automated DAST

Enterprise Edition is a server-based product for scheduled and CI/CD-triggered automated scanning.

### Architecture

```
Burp Enterprise Server
├── Web UI (management, results, scheduling)
├── REST API (CI/CD integration)
├── Database (PostgreSQL — scan history, configs)
└── Scan Agents (Docker-based, scale horizontally)
    └── Each agent runs Burp Scanner headlessly
```

**Deployment:** Docker Compose (test/small) or Kubernetes (enterprise scale).

### Scan Scheduling

- **On-demand:** Triggered via UI or REST API
- **Scheduled:** Cron-based (e.g., weekly scan of main application)
- **CI/CD triggered:** Via REST API from pipeline

### CI/CD Integration

```bash
# Start a scan via REST API
curl -X POST https://burp-enterprise.example.com/api/v1/scans \
  -H "Authorization: $BURP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My App - PR Scan",
    "scan_configurations": [{"id": "ci-quick-scan"}],
    "urls": ["https://test.example.com"],
    "application_logins": [{"login_config_id": "test-app-login"}]
  }'

# Poll for completion
curl https://burp-enterprise.example.com/api/v1/scans/{scan_id} \
  -H "Authorization: $BURP_TOKEN"

# Get results
curl https://burp-enterprise.example.com/api/v1/scans/{scan_id}/issues \
  -H "Authorization: $BURP_TOKEN"
```

**GitHub Actions (official):**
```yaml
- name: Burp Enterprise DAST
  uses: PortSwigger/enterprise-scan-action@v1
  with:
    burp-enterprise-url: ${{ vars.BURP_ENTERPRISE_URL }}
    api-key: ${{ secrets.BURP_API_KEY }}
    url: https://test.example.com
    scan-config: ci-quick-scan
```

### Burp Suite DAST (Docker-based, 2025.12+)

A lightweight Docker-based DAST product for CI/CD:
```bash
docker run --rm \
  -e BURP_START_URL=https://test.example.com \
  -e BURP_REPORT_FILE_PATH=/output/report.html \
  -v $(pwd)/output:/output \
  public.ecr.aws/portswigger/burp-suite-dast:latest
```

This is distinct from Enterprise Edition — it's a simpler, containerized DAST runner.

---

## REST API (Enterprise)

The Enterprise REST API enables programmatic control:

```
GET  /api/v1/scans                    # List scans
POST /api/v1/scans                    # Create scan
GET  /api/v1/scans/{id}               # Scan status
GET  /api/v1/scans/{id}/issues        # Issues list
GET  /api/v1/scans/{id}/report.html   # HTML report
GET  /api/v1/scans/{id}/report.xml    # XML report
POST /api/v1/scans/{id}/cancel        # Cancel scan
GET  /api/v1/scan-configurations      # List configs
GET  /api/v1/application-logins       # Auth configs
```

---

## Reference Files

- `references/architecture.md` — Burp Suite internals: proxy engine, scanner architecture, Intruder mechanics, extension API, Enterprise server architecture, Collaborator server, BCheck runtime