{"id":21573713,"url":"https://github.com/syss-research/burp-extender-json-api","last_synced_at":"2025-09-11T22:33:16.746Z","repository":{"id":45157192,"uuid":"255852075","full_name":"SySS-Research/burp-extender-json-api","owner":"SySS-Research","description":"A Burp extension that provides an API to build other extensions in any programming language","archived":false,"fork":false,"pushed_at":"2023-11-14T23:25:54.000Z","size":20526,"stargazers_count":8,"open_issues_count":1,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-07-24T13:02:13.282Z","etag":null,"topics":["burp","burp-extensions","burpsuite","java","json","pentest-tool","pentesting","python","rest"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SySS-Research.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-04-15T08:24:06.000Z","updated_at":"2025-03-22T20:27:02.000Z","dependencies_parsed_at":"2025-04-10T16:12:09.348Z","dependency_job_id":"ea30762c-bc18-4925-af36-4d72300562ad","html_url":"https://github.com/SySS-Research/burp-extender-json-api","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/SySS-Research/burp-extender-json-api","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fburp-extender-json-api","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fburp-extender-json-api/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fburp-extender-json-api/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fburp-extender-json-api/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SySS-Research","download_url":"https://codeload.github.com/SySS-Research/burp-extender-json-api/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fburp-extender-json-api/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274718228,"owners_count":25337075,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-11T02:00:13.660Z","response_time":74,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["burp","burp-extensions","burpsuite","java","json","pentest-tool","pentesting","python","rest"],"created_at":"2024-11-24T12:07:46.726Z","updated_at":"2025-09-11T22:33:16.718Z","avatar_url":"https://github.com/SySS-Research.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Burp Extender JSON API\nThis extension exposes parts of the burp extension API via a JSON API.\n\n## Why?\nAs pentesters, we often have to inspect and modify data which is sent via HTTP and burp is a very good tool for this\npurpose. However, as soon as you need other strange software for proprietary protocols, custom crypto implementations,\ncompression or other stuff, it gets too time consuming to build an extension within a short time period.\n\nAs an additional benefit, this API allows you to build extensions without knowing the burp extension API. You can\nuse any software, it just has to be able to speak JSON via HTTP. No need for Java, Jython etc!\n\nBasically, this extensions tries to make use of the great burp features without reimplementing logic for request\nmodification or similar, while giving you the freedom to use any programming language you like. A sample implementation\nis provided as as PoC in pure Python (not Jython!) in the folder `python`. You can start there if you want to see\nhow it works.\n\n## Limitations\nBuilding extensions with a custom UI is currently not possible. Also, not all features of burp are implemented (yet).\n\n## Getting Started\nClone the repo.\n\n### Build from source or use the pre-compiled version\nYou can build the burp extension itself from source.\n```\ncd burp-extension\nmvn package\n```\nYou'll find the result in `target/burp-json-api-1.0-SNAPSHOT.jar`.\n\nOr use a pre-compiled release version.\n\n## Activate the extension in burp\nLoad the extension in burp the usual way. Please keep in mind that the order matters!\n\n[![Video: Add extension](/images/add-extension.jpg)](https://github.com/SySS-Research/burp-extender-json-api/blob/master/videos/add-extension.mp4?raw=true \"Add extension\")\n\n# Use the extension API\nAfter loading the extension, a new HTTP service is provided on localhost port 8099. The sample implementation with\npython in the folder `python` will give you a good start.\n\n## Usage\n* After adding the extension in burp, an access token will be generated and logged in the extension output\n* Use the API with this token\n\n### Python Example\n* Change to directory `python`\n* Set up a virtual environment like you would do with any python project and install the requirements\n(`python -m venv venv; ./venv/bin/activate; pip install -r requirements.txt`)\n* Start an extension by using app.py and the name of the extension you want to use (check folder `python/extensions`)\n```\ni.e. ./app.py -auth [auth token] -extension [extension1[ extension2]]\n# This will add an additional tab i.e. in the proxy and pretty print JSON/XML.\n./app.py -auth 0f6dabf6-7e5a-486a-a302-d3c7ab1444dd -extension messageeditortabprettyprint\n# This will also load the sample \"httplisteneraddheader\"\n./app.py -auth 0f6dabf6-7e5a-486a-a302-d3c7ab1444dd -extension messageeditortabprettyprint httplisteneraddheader\n```\n\nThere are different extensions available in `python/extensions`. Check out the code for the details.\n\n[![Video: Use extension](/images/use-extension.jpg)](https://github.com/SySS-Research/burp-extender-json-api/blob/master/videos/use-extension.mp4?raw=true \"Use extension\")\n\n## Currently supported functions\n* IntruderPayloadGenerator\n* IntruderPayloadProcessor\n* MessageEditorTab\n* ScannerInsertionPoint\n* SessionHandlingAction\n* ProxyListener\n* HttpListener\n\n## Data structures\nAs described above, the tool just uses burp to do all the work. Most data structures are basically like in the burp\nextensions, just serialized (and base64 encoded). Some examples are given below.\n\n### Request\nA request may look like this:\n```\n'request':\n    b'POST /some/url HTTP/1.1\\r\\nHost: test.example.org\\r\\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\\r\\nAccept: */*\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip,\n    deflate\\r\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\r\\nX-Requested-With: XMLHttpRequest\\r\\nContent-Length: 125\\r\\nConnection: close\\r\\nCookie: ASP.NET_SessionId=foobar; foo=bar\\r\\n\\r\\nparam=test\u0026param2=1\u0026',\n```\n### Response\nA response may look like this:\n```\n'response':\n    b'HTTP/1.1 200 OK\\r\\nDate: Thu, 08 Aug 2019 08:49:04 GMT\\r\\nServer: Apache\\r\\nCache-Control: private\\r\\nContent-Type: text/xml; charset=utf-8\\r\\nX-XSS-Protection: 1; mode=block\\r\\nStrict-Transport-Security: max-age=31536000; includeSubDomains\\r\\nContent-Length: 1700\\r\\nConnection: close\\r\\n\\r\\nhttp body here',\n```\n\n### AnalyzedRequest\nAn analyzed request may look like this:\n```\n'analyzedRequest': {\n    'url': 'https://test.example.org:443/foobar',\n    'bodyOffset': 1331,\n    'method': 'POST',\n    'parameters': [{\n        'nameEnd': 420,\n        'valueStart': 421,\n        'valueEnd': 445,\n        'nameStart': 403,\n        'name': 'ASP.NET_SessionId',\n        'value': 'nz4g5a3xhfjqm0zzmaaaw3qq',\n        'type': 2},\n        {'nameEnd': 499,\n        'valueStart': 500,\n        'valueEnd': 592,\n        'nameStart': 447,\n        'name': '__RequestVerificationToken_asd457fuNDYvUG1nLkFkbWlu0',\n        'value': 'foo...',\n        'type': 2},\n    ],\n    'contentType': 1,\n    'headers': [\n\t\t'POST /foo/foobar HTTP/1.1',\n    \t'Host: test.example.org',\n\t    'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',\n\t    'Accept: */*',\n\t    'Accept-Language: en-US,en;q=0.5',\n    \t'Accept-Encoding: gzip,deflate',\n\t    'Content-Type: application/x-www-form-urlencoded; charset=UTF-8',\n    \t'X-Requested-With: XMLHttpRequest',\n\t    'Content-Length: 125',\n    \t'Connection: close',\n\t    'Cookie: ASP.NET_SessionId=nzzg5a3thfjqm0zzma01w3qq;'\n\t]\n}\n```\n\n### AnalzyzedResponse\nA analyzed response may look like this:\n```\n'analyzedResponse': {\n    'statusCode': 200,\n    'bodyOffset': 273,\n    'cookies': [],\n    'statedMimeType': 'XML',\n    'inferredMimeType': 'XML',\n    'headers': [\n\t\t'HTTP/1.1 200 OK',\n\t    'Date: Thu, 08 Aug 2019 08:49:04 GMT',\n    \t'Server: Apache',\n\t    'Cache-Control: private',\n    \t'Content-Type: text/xml; charset=utf-8',\n\t    'X-XSS-Protection: 1; mode=block',\n    \t'Strict-Transport-Security: max-age=31536000; includeSubDomains',\n\t    'Content-Length: 1700',\n    \t'Connection: close'\n\t]\n}\n```\n\n### AnalyzedMessage\nAn analyzed message wraps request/response and may look like this:\n```\n{\n'toolFlag': 0,\n'request': {see Request},\n'response': None,\n'analyzedRequest': {see AnalyzedRequest},\n'analyzedResponse': None\n}\n```\n\n### InterceptedMessage\nAn intercepted message may look like this:\n```\n{'analyzedRequest': {see analyzedRequest},\n 'analyzedResponse': {see analyzedRespone},\n 'message': {\n    'clientIpAddress': 'localhost.localdomain',\n    'interceptAction': 0,\n    'listenerInterface': '127.0.0.1:8080',\n    'messageInfo': {\n        'comment': None,\n        'highlight': None,\n        'host': 'test.example.org',\n        'httpService': {\n            'host': 'test.example.org',\n            'port': 443,\n            'protocol': 'https'\n        },\n        'port': 443,\n        'protocol': 'https',\n        'request': 'see Request',\n        'response': 'see Response',\n        'statusCode': 0,\n        'url': 'https://test.example.org:443/foo/bar?param=1'},\n        'messageReference': 474\n    }\n}\n```\n\n## Author\nTorsten Lutz, SySS GmbH, 2019 - 2020\n\n## Disclaimer\nUse at your own risk.\n\n## Acknowledgements\nThanks to @mbechler for the code review and remarks.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fburp-extender-json-api","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsyss-research%2Fburp-extender-json-api","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fburp-extender-json-api/lists"}