log4j

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading This script is based from takito1812/log4j-detect By ExodataCyberdefense The script "log4j-detect.py" developed in Python 3 is responsible for detecting whethe...

JSpector

JSpector JSpector is a Burp Suite extension that passively crawls JavaScript files and automatically creates issues with URLs, endpoints and dangerous methods found on the JS files. Prerequisites Before installing JSpector, you need to have Jython installed on Burp Suite. Installation 1. Download...

burp-text4shell

Text4Shell scanner for Burp Suite Detailed description can be found in our blog post about this plugin. Note about detection capabilities: this plugin will only supply the built-in active scanner with payloads, thus for optimal coverage vs. performance, you'll have to configure your scan properly...

generator-burp-extension

Burp Extension Generator Installation First, install Yeoman and generator-burp-extension using npm we assume you have pre-installed node.js. npm install -g yo npm install -g generator-burp-extension Then generate your new project: yo burp-extension Burp Extension features When you generate your...

burp-reflux

Burp Proxy reflux log parser: Burp proxy text log converter to CSV and SQLLite Reflux for Burp log parsing and conversion Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

OAUTHScan

OAUTHScan Description OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards. The plugin looks for various OAUTHv2/OpenID vulnerabilities...

BurpSuiteJSBeautifier

Burp Suite JSBeautifier Most of the websites compress their resources such as JS files in order to increase the loading speed. However, security testing and debugging a compressed resource is not an easy task. This is a Burp Suite open source extension which makes it possible to beautify most of...

CVE-2025-53770-Vulnerable-Scanner

Pre-Exploit Vulnerability Check for CVE-2025-53770 with Burp Suite Proxy This script checks a list of SharePoint hosts for vulnerability to CVE-2025-53770 using a custom payload and routes all requests through Burp Suite's proxy for interception and analysis. Features Checks single or multiple...

Decoder-Improved

Decoder Improved tl;dr Within extender load Decoder-Improved.jar latest release For a walkthrough on how to extend Decoder Improved visit ourblog post. The link to the original description seems to be broken. While there's no up-to-date walkthrough about how to extend Decoder Improved at the...

headerpwn

headerpwn A fuzzer for analyzing how servers respond to different HTTP headers. 🏗️ Install ⛏️ Usage 📡 Proxying HTTP Requests Install To install headerpwn, run the following command: go install github.com/devanshbatham/[email protected] Usage headerpwn allows you to test various headers on a...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install GO111MODULE=on go install github.com/jaeles-project/gospider@latest Docker...

ParaForge

ParaForge ParaForge is a simple Burp Suite extension to extract the paramters and endpoints from the request to create custom wordlist for fuzzing and enumeration. This is just a simple extension for easy usage. There are more advance and better options available. Features Extract endpoint Extrac...

AuthMatrix

AuthMatrix v0.8.2 AuthMatrix is an extension to Burp Suite that provides a simple way to test authorization in web applications and web services. With AuthMatrix, testers focus on thoroughly defining tables of users, roles, and requests for their specific target application upfront. These tables...

ReconAIzer

ReconAIzer ReconAIzer is a powerful Jython extension for Burp Suite that leverages OpenAI to help bug bounty hunters optimize their recon process. This extension automates various tasks, making it easier and faster for security researchers to identify and exploit vulnerabilities. Once installed,...

MITM_Intercept

MITMIntercept A little bit less hackish way to intercept and modify non-HTTP protocols through Burp and others with SSL and TLS interception support. This tool is for researchers and applicative penetration testers that perform thick clients security assesments. An improved version of the fantast...

archerysec

Support. Your generous donations will keep us motivated. Paypal: Archery Overview of the tool Note Requirements OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners Installation Windows Installation Note on installation for developers and contributors Note on manual and automated installatio...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

Log4j-RCE-Exploiter

Log4j-RCE-Exploiter Scanner for Log4j RCE CVE-2021-44228 Installation For installation, Run the Following command with SUPERUSER ROOT ▶ cd Log4j-RCE-Exploiter ▶ chmod 777 installer.sh ▶ ./installer.sh Usage ▶ log4jExploiter -d tesla.com -b 6nuulng8dd2sivtd3kht31s9e0kq8f.burpcollaborator.net -h,...

JDSer-ngng

JDSer-ngng A Burp Extender plugin, that will deserialized java objects and encode them in XML using the Xtream library. Why? This release fixes the bug in the other implementation in JDSer-ng which didn't actually allow modification of the request. Also extends it further, allowing proper use of...

WCFDSer-ngng

WCFDSer-ngng A Burp Extender plugin, that will make binary soap objects readable and modifiable. Based on the original work of Brian Holyfield, all hail Brian http://blog.gdssecurity.com/labs/2009/11/19/wcf-binary-soap-plug-in-for-burp.html Why? This release fixes a bug where serialization wasn't...