burpgpt

!IMPORTANT Announcing the launch of BurpGPT Pro, the edition specifically tailored to meet the needs of professionals and cyber boutiques. Discover a host of powerful features and a user-friendly interface that enhances your capabilities and ensures an optimal user experience. To access these...

jwt-key-id-injector

JWT Key ID Injector Simple python script to check against hypothetical JWT vulnerability. Let's say there is an application that uses JWT tokens signed HS256 algorithm. An example token looks like the follow: root@kitploit:...

403Kangaroo

403Kangaroo !! Esta herramienta aún está en desarrollo; si tienes algún problema, no dudes en contactarme a través de LinkedIn o algo así Herramienta de bypass 403/401 mediante ciertos encabezados y valores headers.txt,values.txt. Cuando cargas la extensión por primera vez, abrirá un archivo...

CVE-2024-23692

CVE-2024-23692 BURP POC root@kitploit: GET /?n=%0A&cmd=ipconfig+/all&search=%25xxx%25url:%password%.exec|.?cmd.|timeout=15|out=abc..?n..?n.RESULT:.?n..^abc.====.?n. HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept:...

Log4j-check

Log4j-check Supports RC1 bypass log4j Burp scanning plugin, CVE-2021-44228, supports RC1 bypass, supports JSON data types, supports dnslog.cn and Burp's built-in DNS, can be used with JNDIExploit to generate payloads Modified based on @pmiaowu's fastjson plugin. The original author used dnslog.cn...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

femida

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/wish-i-was/femida.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field called "Your url" and press Enter ...

ParaForge

ParaForge ParaForge is a simple Burp Suite extension to extract the paramters and endpoints from the request to create custom wordlist for fuzzing and enumeration. This is just a simple extension for easy usage. There are more advance and better options available. Features Extract endpoint Extrac...

BurpSuite_Pro_v1.7.37

Update burpsuiteprov2.0beta.jar root@kitploit: Burp Suite 2.0 beta is now available for Professional users. This is a major upgrade with many new features, including: A new crawler that is able to automatically handle sessions, detect changes in application state, handle multiple login captures,...

Burp_AES_Plugin

Burpsuite Plugin For AES Crack 0x00 mvn install to get jar git clone https://github.com/jas502n/BurpAESPlugin/ cd /github/BurpAESPlugin/AESDecode vi src/main/java/burp/BurpExtender.java mvn install root@kitploit: INFO --- maven-install-plugin:2.4:install default-install @ AESCrack --- INFO...

BlackThrone

BlackThrone PHP BlackThrone Script Una alternativa de código abierto a burp collaborator BlackThrone creado para detectar tráfico websockets y HTTP en el sitio web principal, proporcionando algunos encabezados del servidor e información del cliente. BlackThrone es una herramienta basada en web pa...

CVE-2025-55182

CVE-2025-55182 https://github.com/user-attachments/assets/0da9a623-fe2a-4a96-8192-7a07a76635d7 React2Shell Scanner - Burp Suite Extension Description React RCE Scanner is a Burp Suite extension designed to detect and exploit the React vulnerability CVE-2025-55182 Remote Code Execution in React...

react2shell-burp

React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...

CVE-2026-39636-vulnerability-exp

1. Burp Suite must be opened before running here !! And the default Burp Suite port must be 8080. If it is different, you can change it yourself. 2. Download the required libraries root@kitploit: pip install websockets==16.0 -i https://pypi.tuna.tsinghua.edu.cn/simple 3. Just run it directly...

Cookie-Swapper

Cookie Swapper Burp Suite extension that auto-replaces cookies and headers in requests. Stop wasting time copy-pasting session tokens into every request. Why? You got a retest, a needs more info bug, or just expired sessions. You need to replay dozens of requests from HTTP History and Repeater bu...

CVE-2025-55182-burpscanner

CVE-2025-55182-burpscanner A Burp Suite passive scanning plugin for detecting CVE-2025-55182, using JDK 17 Plugin Usage: Default scanning of history / right-click active scan. When a vulnerability is detected, it automatically goes to the CVE-2025-55182 module. Deduplication Deduplication Mechani...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Interactive shell HTTP hijack + POST + AES-256-CBC/BASE64 Detection -dnslog DNSLog No-Output Detection Nuclei -poc Vulnerability Echo Detection Exploitation -exp Interactive shell base64 echo -exp2 Interactive shell HTTP hijack + POST + Base64 -exp3...

pentest-mapper

Pentest Mapper Pentest Mapper is a Burp Suite extension that integrates the Burp Suite request logging with a custom application testing checklist. The extension provides a straightforward flow for application penetration testing. The extension includes functionalities to allow users to map the...

mongobleedburp

MongoBleed Burp Extension Burp Suite extension to detect CVE-2025-14847 MongoBleed via manual leak tests from a dedicated UI tab. Repository: https://github.com/j0lt-github/mongobleedburp Current version: 1.1.0 Features Manual test UI tab with host/port and min/max offsets Temporary-file leak...

oauth-scan

OAUTHScan Description OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards. The plugin looks for various OAUTHv2/OpenID vulnerabilities...