This folder contains example implementations demonstrating different capabilities of the Burp Suite Python extension. Each example showcases specific features and use cases for writing Burp extensions in Python.

All examples implement the IBurpExtender interface and should be saved as BurpExtender.py in the Lib folder before launching Burp Suite. The extensions leverage Jython to bring Python's dynamic capabilities to Burp Suite extension development.

Purpose: Demonstrates the simplest possible Burp extension with basic message manipulation.

What it does:

• Intercepts all HTTP responses passing through Burp Proxy
• Performs a simple string replacement: replaces every occurrence of "java" with "python"
• Shows the basic structure of a Burp extension using the processProxyMessage method

Use case:

• Learning the basic extension structure
• Simple content modification for testing purposes
• Quick proof-of-concept for response manipulation

Code highlights:

def processProxyMessage(self, ...):
    if not messageIsRequest:
        message = message.tostring().replace("java","python")
    return message

Purpose: Embeds an interactive Python interpreter for real-time inspection and manipulation of HTTP messages.

What it does:

• Intercepts HTTP responses for URLs within Burp's defined scope
• Launches an interactive Python console when a response is intercepted
• Provides access to all method parameters (URL, headers, message content, etc.)
• Allows you to inspect, modify, and experiment with message data in real-time
• Any variables modified in the interactive session are preserved and returned to Burp

Use case:

• Interactive debugging and analysis of HTTP traffic
• Real-time message manipulation without restarting Burp
• Exploring available parameters and testing modifications on the fly
• Educational purposes - learning how Burp messages are structured

Key features:

• Only processes messages within scope (prevents console spam)
• Access to pprint for pretty-printing data structures
• Full Python REPL environment with all message context available
• Changes made in the console are applied to the actual message

Code highlights:

if self.mCallBacks.isInScope(uUrl):
    loc = dict(locals())
    c = InteractiveConsole(locals=loc)
    c.interact("Interactive python interpreter")

Purpose: Adds custom menu items to Burp Suite's contextual menus for comparing request parameters.

What it does:

• Registers a custom menu item called "python diff" in Burp's right-click context menu
• Compares GET and POST parameters between two selected HTTP requests
• Identifies parameters that exist in one request but not the other
• Highlights parameter values that differ between the two requests
• Outputs the comparison results to the console

Use case:

• Quickly compare parameters across different requests
• Identify differences when testing variations of requests
• Analyze parameter changes during session testing
• Detect inconsistencies in request structures

Requirements:

• Burp Suite Professional v1.3.07 or later (custom menu items not available in free version)

How to use:

1. Select exactly two HTTP requests in Burp (in Proxy history, Site map, etc.)
2. Right-click and select "python diff" from the context menu
3. View the parameter comparison in the console

Code highlights:

def registerExtenderCallbacks(self, callbacks):
    callbacks.registerMenuItem("python diff", ArgsDiffMenuItem())

class ArgsDiffMenuItem(IMenuItemHandler):
    def menuItemClicked(self, menuItemCaption, messageInfo):
        # Compare GET and POST parameters

Purpose: Integrates w3af (Web Application Attack and Audit Framework) plugins with Burp Suite for passive vulnerability scanning.

What it does:

• Loads and executes w3af plugins directly within Burp Suite
• Passively scans all HTTP traffic using w3af's grep plugins
• Reports identified vulnerabilities in Burp's Alert tab and console
• Supports w3af grep plugins (passive scanning) and evasion plugins (request modification)
• Each response passing through Burp is automatically analyzed by the configured w3af plugins

Supported plugin categories:

• grep plugins: Passive analysis plugins that scan responses for vulnerabilities
  • Examples: DOM XSS detection, error page identification, private IP disclosure, SSN detection, etc.
• evasion plugins: Modify requests to evade detection (limited support)

Configuration required:

1. Edit the plugins list to specify which w3af plugins to load:

   plugins = ['grep.domXss', 'grep.error500', 'grep.errorPages', ...]

2. Set the path to your w3af installation:

   w3afPath = "C:\\local\\Program Files\\w3af\\w3af"  # Windows
   # or
   w3afPath = "/usr/local/w3af/w3af"  # Unix/Linux/Mac

Available grep plugins (examples):

• grep.domXss - Detects potential DOM-based XSS vulnerabilities
• grep.error500 - Identifies internal server errors
• grep.errorPages - Finds error pages and stack traces
• grep.privateIP - Detects private IP address disclosure
• grep.ssn - Finds Social Security Numbers in responses
• grep.hashFind - Identifies password hashes
• grep.httpAuthDetect - Detects HTTP authentication
• grep.strangeHeaders - Identifies unusual HTTP headers
• grep.wsdlGreper - Finds WSDL files

Use case:

• Automated passive vulnerability scanning during manual testing
• Leveraging w3af's extensive plugin library without leaving Burp
• Continuous security assessment of all proxied traffic
• Combining Burp's interception capabilities with w3af's detection rules

Limitations:

• Not all w3af plugin categories are supported (mainly grep and evasion)
• Some plugins requiring sqlite3 won't work out of the box (Jython limitation)
  • Can be resolved using sqlite JDBC support if needed
• Evasion plugin support has some issues with HTTP header ordering
• Plugins that fail to load are silently ignored

Requirements:

• w3af installation (tested with v1.0-rc3)
• w3af path correctly configured in the script

Output: When vulnerabilities are detected, you'll see:

• Detailed descriptions in the console
• Alerts in Burp's Alert tab
• Issue descriptions prefixed with "w3af"

1. Choose the example that fits your needs
2. Copy the example file and rename it to BurpExtender.py
3. Place it in the Lib folder of your Burp Python installation
4. Launch Burp Suite using the provided suite.bat (Windows) or suite.sh (Linux/Mac)
5. The extension will automatically load when Burp starts

All examples are designed to be educational and can be modified to suit your specific needs:

• Combine features from multiple examples
• Add your own message processing logic
• Integrate with other Python libraries
• Create custom menu items for your workflows

• Main project README: ../README.md
• Burp Extender API documentation
• w3af project: http://w3af.sourceforge.net

• Ensure BurpExtender.py is in the Lib folder
• Check console output for any Python errors
• For w3af example: verify w3af path is correct and w3af modules are accessible
• For menu example: ensure you're using Burp Suite Professional v1.3.07+

Note: This project is now archived as Python extensions are natively supported in modern versions of Burp Suite. These examples remain valuable for historical reference and for those working with legacy Burp versions.