PortSwigger/BChecks

Stars
320
Rank 130,927 (Top 3 %)
Language
License
GNU Lesser Genera...
Created over 1 year ago
Updated about 1 year ago

PortSwigger/BChecks

PortSwigger

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

BChecks collection for Burp Suite Professional

BChecks

Burp Suite Professional BChecks developed both by PortSwigger and the community with 🧡

Documentation and Blogs

If you click the ? Icon in the top right of the BChecks sub tab in the Extensions tab you will be linked to the documentation.

Online documentation can be found here

BChecks: Houston, we have a solution! (blog)

Burp Suite Short (video)

Community submissions

Please issue a pull request and follow the process outlined here

the BChecks

Examples

Example BChecks to help you get started covering

Blind SSRF via out-of-band detection
Exposed git directory
Leaked AWS Tokens
Log4Shell via out-of-band detection
Server Side Prototype Pollution
Suspicious Input Transformation

Vulnerabilities CVEd

BChecks for specific vulnerabilities which have a CVE

/vulnerabilities-CVEd

Vulnerability classes

BChecks for specific vulnerability classes as opposed to discrete vulnerabilities.

/vulnerability-classes

Other

Other BChecks doing all the wonderful things which we didn't imagine

turbo-intruder

Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.

param-miner

http-request-smuggler

backslash-powered-scanner

Finds unknown classes of injection vulnerabilities

xss-cheatsheet-data

This repository contains all the XSS cheatsheet data to allow contributions from the community.

collaborator-everywhere

A Burp Suite Pro extension which augments your proxy traffic by injecting non-invasive headers designed to reveal backend systems by causing pingbacks to Burp Collaborator

hackability

Probe a rendering engine for vulnerabilities and other features

bypass-bot-detection

Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection

dastardly-github-action

Runs a scan using Dastardly by Burp Suite against a target site and creates a JUnit XML report for the scan on completion.

js-link-finder

Burp Extension for a passive scanning JS files for endpoint links.

portable-data-exfiltration

This repo contains all the injections mentioned in my talk and enumerators.

distribute-damage

Evenly distributes scanner load across targets

httpoxy-scanner

A Burp Suite extension that checks for the HTTPoxy vulnerability.

replicator

Burp extension to help developers replicate findings from pen tests

burp-extensions-montoya-api

Burp Extensions Api

burp-extender-api

Burp Wiener API (Legacy)

python-scripter

Sourced from gist: https://gist.github.com/mwielgoszewski/7026954

css-exfiltration

serialization-examples

aws-security-checks

AWS Security Checks

example-hello-world

server-side-prototype-pollution

burp-extensions-montoya-api-examples

Examples for using the Montoya API with Burp Suite

example-intruder-payloads

example-scanner-checks

reflected-parameters

nice-script

A JavaScript sandbox using proxies

custom-logger

example-custom-editor-tab

example-event-listeners

bseept

Burp Suite Enterprise Edition Power Tools

research-labs

This repository contains a number of insecure self-hosted applications that allows interested security engineers to test vulnerabilities found by Portswigger Research team.

3d-css-tutorial

example-custom-scan-insertion-points

extended-macro

ExtendedMacro - BurpSuite plugin providing extended macro functionality

waf-detect

Burp app (BApp) for detecting WAF fingerprints

enterprise-reference-stack-for-aws

viewstate-editor

Burp extension to add a view state tab to the message editor

exiftool-scanner

Burp extension, reads metadata using ExifTool

random-ip-address-header

html5-auditor

what-the-waf

Try harder to bypass that WAF...

certsquirt

A golang PKI in less than 1000 lines of code.

example-custom-session-tokens

example-custom-logger

manual-scan-issues

splunk-connector

ActiveEvent is a Burp plugin that integrates Burp Scanner and Splunk events

websphere-portlet-state-decoder

burp-jenkins-integration

Enterprise integration with Jenkins

open-day

enterprise-helm-charts

Helm charts for BSEE Kubernetes installation.