Open-source alternatives to Stepper

Adds a customizable "Send to..."-context-menu to your BurpSuite.

Because just a dark theme wasn't enough!

Reclaim control of your Burp Suite Repeater tabs with this powerful extension

XSStrike is a security tool designed to detect cross-site scripting vulnerabilities through parameter fuzzing and web response analysis. It functions as a web application fuzzer and vulnerability scanner that identifies injection points and security flaws. The project includes a specialized utility for detecting blind XSS, where payloads execute asynchronously or on separate pages. It also features a JavaScript library auditor to identify outdated libraries with known vulnerabilities and a dedicated tool for identifying and bypassing web application firewalls using various evasion techniques.

dirsearch is a command-line security tool and web path scanner used for discovering hidden directories and files on web servers. It functions as a recursive directory fuzzer and brute-force utility that identifies undocumented paths and sensitive files using wordlists and HTTP status codes. The tool distinguishes itself through template-driven path generation and an automated HTTP response filter that uses status codes, content length, and regex patterns to isolate valid targets. It supports recursive directory crawling to map complex web structures and provides state-persistence serializatio

PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.

Burp Suite extension that automatically highlights different HTTP requests

A burp extension that add some useful function to Context Menu 添加一些右键菜单让burp用起来更顺畅

reCAPTCHA = REcognize CAPTCHA: A Burp Suite Extender that recognize CAPTCHA and use for intruder payload 自动识别图形验证码并用于burp intruder爆破模块的插件

A BurpSuite extension to create a custom word-list of endpoint and parameters for enumeration and fuzzing

Burp extension that checks application requests and responses for indicators of vulnerability or targets for attack

A Burp Suite Extension to pull Employee Names from Google and Bing LinkedIn Search Results

Burp extension for quickly copying request/response data.

Burp Plugin - Conditional Match and Replace (CMAR)

HackBar plugin for Burpsuite

Useful "Match and Replace" burpsuite rules

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

A plugin for Burp Suite Pro to work with attacker payloads and automatically generate check digits for credit card numbers and similar numbers that end with a check digit generated using the Luhn algorithm or formula (also known as the "modulus 10" or "mod 10" algorithm).

HAR importer

Timeinator is an extension for Burp Suite that can be used to perform timing attacks over an unreliable network such as the internet.

A BurpSuite extension to aid pentesting web applications that use Blazor Server/BlazorPack. Primary functionality includes converting BlazorPack messages to JSON and vice versa, introduces tamperability for BlazorPack serialized messages.