Mastering Burp Suite

On Day 3 of @why2025.bsky.social (aka Sunday) at 5:00 PM, I'll give a 15-minute talk titled "Python3-based editors in Burp Suite" at the Cyber_Saiyan village.

wiki.why2025.org/Village:Cybe...

And if you're not interested in Burp Suite, we could nonetheless meet at the arcade room 🎮🕹️🙃

Freebies - Mastering Burp Suite Pro Freebies - Mastering Burp Suite Pro

I just added the 15-minute talk I gave at Tumpicon to the "Freebies" section.

This talk covers the extensions Piper and Scalpel, and allows users to easily manipulate encrypted data by shuffling blocks around

hackademy.agarri.fr/freebies

Freebies - Mastering Burp Suite Pro Freebies - Mastering Burp Suite Pro

I just added the 15-minute talk I gave at Tumpicon to the "Freebies" section.

This talk covers the extensions Piper and Scalpel, and allows users to easily manipulate encrypted data by shuffling blocks around

hackademy.agarri.fr/freebies

You're not ready for how powerful Custom Actions are.
You can now build your own AI hacking sidekicks that rewrite requests for you.
Forget typing payloads - just let your assistant do it.
🔥 Welcome to the future of offensive automation.

Get the source code:
github.com/PortSwigger/...

A meme based on the "Change my mind" template (not the Steven Crowder's one, but one from the Calvin & Hobbes comics) The text says "Chaining two instances of Burp Suite is such an underrated technique"

We've just released a massive update to Collaborator Everywhere! This is a complete rewrite by @compass-security.com which adds loads of features including in-tool payload customization. Massive thanks to Compass for this epic project takeover. Check out the new features:

Concerned about LLM-powered pentesters stealing your job? We've made improving your workflow with AI easier than ever - you can now build your own AI features directly inside Repeater with Custom Actions. Here's one I built for myself:

Piper is an excellent swiss knife 🛠️

bsky.app/profile/agar...

If you're confused by the amount of resources stored in the JAR, here's a hint 🔎

Check out "resources/Scanner/jwt_secrets.txt". It contains over 100k passwords used by the passive scanner to decrypt JWT tokens 🗝️

And it works: that's how @evilpacket.net scored a $1500 bug affecting Cursor 💰

I can't think of any good resources discussing the JAR file itself. But everything interesting is stored in the "resources" top directory.

For example, the sub-directory "PayloadStrings" contains the built-in wordlists which are available from Intruder.

If you're confused by the amount of resources stored in the JAR, here's a hint 🔎

Check out "resources/Scanner/jwt_secrets.txt". It contains over 100k passwords used by the passive scanner to decrypt JWT tokens 🗝️

And it works: that's how @evilpacket.net scored a $1500 bug affecting Cursor 💰

a cartoon character is riding a pile of gold coins . ALT: a cartoon character is riding a pile of gold coins .

Never opened the Burp Pro JAR file as a ZIP archive?
You should give it a try...

A basic example where chaining two instances is useful: the lower one runs a scan, and the upper one modifies (some of) the payloads via Match & Replace

It really depends on the context….

A generic example is that you can apply Match & Replace rules upstream and have the downstream Scanner/Repeater traffic impacted.

Screenshot of the Scalpel script editor using the local `vim` binary

The Scalpel extension is magic 🪄 Especially if you're a big fan of executing both python3 and vim within Burp Suite 🛠️

blog.lexfo.fr/scalpel.html

Screenshot of the Scalpel script editor using the local `vim` binary

The Scalpel extension is magic 🪄 Especially if you're a big fan of executing both python3 and vim within Burp Suite 🛠️

blog.lexfo.fr/scalpel.html

A meme based on the "Change my mind" template (not the Steven Crowder's one, but one from the Calvin & Hobbes comics) The text says "Chaining two instances of Burp Suite is such an underrated technique"

Opened 7 tickets with Portswigger support in one week.

Sometimes I wonder if they hate me... 🤔

Based on my in-depth knowledge of both Burp Suite and its extensions, this talk aims to provide bug hunters and pentesters with a set of useful strategies. T... NSEC2023 - Burp Suite Pro tips and tricks, the sequel

If you never used the Piper extension, I recommend to watch the 4-minute demo I gave last year during my talk at
NorthSec 🛠️

Active Scan++ just got sharper - we’ve added new checks for OS command injection, powered by our latest ASCII Control Characters research. Install via Extensions -> BApp Store

A small win: since EA 2025.5, Repeater's "Change body encoding" feature also supports JSON 🥳

TIL in the latest Early Adopter version (aka 2025.5), extensions don't need to manage their own settings panel anymore, as they can simply add entries to "Settings > Tools > Extensions" 🤯

And to be honest, I find that awesome! 💎

In case you've a hard time intercepting Firefox traffic to the loopback interface, open the about:config page and set "network.proxy.allow_hijacking_localhost" to True 🎁

Thanks @onemask.bsky.social for the tip 🙏

TIL in the latest Early Adopter version (aka 2025.5), extensions don't need to manage their own settings panel anymore, as they can simply add entries to "Settings > Tools > Extensions" 🤯

And to be honest, I find that awesome! 💎

In case you've a hard time intercepting Firefox traffic to the loopback interface, open the about:config page and set "network.proxy.allow_hijacking_localhost" to True 🎁

Thanks @onemask.bsky.social for the tip 🙏

A nice bug affecting Cursor and identified by @burpsuite.bsky.social passive scanner 😈

A nice bug affecting Cursor and identified by @burpsuite.bsky.social passive scanner 😈

When the same HTTP request gets you 3 different response code, you known something is weird...

And thanks @jameskettle.com for the race condition custom action, it's really convenient to have it directly in Repeater.

Custom actions reference guide Custom actions are scripts that run directly in Burp Repeater to automate tasks and extract information during manual testing. This page includes building ...

Portswigger published a detailed guide on how to write a Custom Action (which is a bambda executed in Repeater)

portswigger.net/burp/documen...

A post by @dustri.org about making Burp Suite faster on Asahi Linux

dustri.org/b/making-bur...