Burpsuite Extensions – A collection of Burp Suite extensions

A collection of BurpSuite extensions.

Burpsuite Extensions gunziper

A plugin for the burpsuite (https://portswigger.net/burp/) which enables you to

  • “unpack” requests/responses (e.g. do an base64decode and afterwards a java deserialisation)
  • the possibility to gather e.g. a CSRF token from responses and automatically insert it in any request (without the need to do an extra request with burps macro functionality)
  • half automatically compare hundreds/thousands of responses for differences
    • Imagine you used intruder to test 10 GET parameters with payloads, and the application simply reflects the whole URL somewhere in the response. Of course, there might be XSS, but what about other vulnerabilities like SQL, XXE, … Sorting for the response size will not trivially point to relevant requests, so intruder comparer comes into play. With it, you can define a regex which strips parts of the response (e.g. the reflected URL) and then iterates over all responses and does a comparison of the last and current response, and if there are some differences, it will show a diff window similar to burp’s comparer. The libraries used for diffing are “Diff Match and Patch” (http://code.google.com/p/google-diff-match-patch) and “java-diff-utils” (http://code.google.com/p/java-diff-utils/).

Pre built jar files can be gathered from http://coding.f-block.org/

Also ReadHUNT – Burp Suite Pro/Free and OWASP ZAP Extensions

SAML ReQuest

A Burpsuite extension to test SAML authentication requests, used in many SSO implementations. It supports decoding and modification of SAML authentication requests and testing IdPs against manipulated requests. It is also integrated with Proxy, Repeater and Intruder, to make the maximum use of Burpsuite tools in testing SAML authentication requests.

R K

Recent Posts

How Does a Firewall Work Step by Step

How Does a Firewall Work Step by Step? What Is a Firewall and How Does…

1 day ago

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

4 days ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

4 days ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

5 days ago

PPLBlade: Advanced Memory Dumping and Obfuscation Tool

PPLBlade is a powerful Protected Process Dumper designed to capture memory from target processes, hide…

5 days ago

HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities If you’re searching for an efficient…

6 days ago