My tweets haven't gone viral in a while now, so I must drop this banger: reburp
And yes, it's a game changer in applicative pentest and bug bounty. Following me was worth it.
Know how BurpSuite's API does not expose all that burpsuite can do in the UI? and how their MCP isn't better? it lets you read findings but can't do the workflows.
reburp is a small burp extension that uses the extension's access to the internal Montoya API object to re-expose it over a localhost OpenAPI REST API to bridge all that a burp extension can do, to your AI agents in seconds !
Your agent can now use burp's:
- active scan, stop/start scans, fuzzing, turbo intruder
- iterate entire sitemap tree
- websockets
- use tools like Generate CSRF PoC
- use other extensions e.g. Autorize
- Create custom Bambda rules and custom scanners
My favorite: you can explore burp features you haven't found in the UI even after 10 years using it
Science
A Burp Suite extension that hands its full internal API to AI agents
Security researcher forefy, CTO at Audit Wizard, wrote reburp, a small extension that re-exposes Burp's internal Montoya API as a localhost REST API. Agents can run active scans, fuzzing and Turbo Intruder, walk the sitemap, generate CSRF PoCs and write custom Bambda rules.
381likes
46reposts
515saves
29Kviews
- Made with
- Burp Suite
- Role
- Security researcher, CTO at Audit Wizard
- Posted
