alphaSeclab/awesome-burp-suite alphaSeclab/awesome-burp-suite

  • Stars
    star
    993
  • Rank 46,124 (Top 1.0 %)
  • Language
  • Created almost 5 years ago
  • Updated over 4 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
alphaSeclab/awesome-burp-suite
github

alphaSeclab

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Awesome Burp Suite Resources. 400+ open source Burp plugins, 400+ posts and videos.

所有收集类项目

BurpSuite

目录

资源收集

工具

文章

Burp组件

Collaborator

工具

文章

Intruder

工具

文章

Repeater

工具

  • [66星][19d] [Java] coreyd97/stepper A natural evolution of Burp Suite's Repeater tool
  • [52星][29d] [Java] portswigger/stepper A natural evolution of Burp Suite's Repeater tool
  • [36星][1m] [Kotlin] typeerror/bookmarks A Burp Suite Extension to take back your repeater tabs
  • [6星][6y] [Perl] allfro/browserrepeater BurpSuite extension for Repeater tool that renders responses in a real browser.

文章

Extender

工具

文章

Macros

工具

文章

Extractor

Spider

平台

Web

WAF

工具

  • [421星][10m] [Java] nccgroup/burpsuitehttpsmuggler A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques
  • [269星][3y] [Java] codewatchorg/bypasswaf Add headers to all Burp requests to bypass some WAF products
  • [8星][7m] [Py] bao7uo/waf-cookie-fetcher WAF Cookie Fetcher is a Burp Suite extension written in Python, which uses a headless browser to obtain the values of WAF-injected cookies which are calculated in the browser by client-side JavaScript code and adds them to Burp's cookie jar. Requires PhantomJS.

文章

HTTP/HTTPS

工具

  • [403星][5m] [Java] nccgroup/autorepeater Automated HTTP Request Repeating With Burp Suite
  • [396星][21d] [Java] portswigger/http-request-smuggler an extension for Burp Suite designed to help you launch HTTP Request Smuggling attack
  • [391星][11d] [Kotlin] portswigger/turbo-intruder a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
  • [240星][2m] [Py] m4ll0k/burpsuite-secret_finder Burp Suite extension to discover apikeys/accesstokens and sensitive data from HTTP response.
  • [128星][15d] [Py] redhuntlabs/burpsuite-asset_discover Burp Suite extension to discover assets from HTTP response.
  • [103星][2y] [Java] gosecure/csp-auditor Burp and ZAP plugin to analyse Content-Security-Policy headers or generate template CSP configuration from crawling a Website
  • [69星][12d] [Java] c0ny1/httpheadmodifer 一款快速修改HTTP数据包头的Burp Suite插件
  • [54星][6m] [Py] gh0stkey/jsonandhttpp Burp Suite Plugin to convert the json text that returns the body into HTTP request parameters.
  • [51星][2y] [Java] netspi/burpextractor A Burp extension for generic extraction and reuse of data within HTTP requests and responses.
  • [33星][12m] twelvesec/bearerauthtoken This burpsuite extender provides a solution on testing Enterprise applications that involve security Authorization tokens into every HTTP requests.Furthermore, this solution provides a better approach to solve the problem of Burp suite automated scanning failures when Authorization tokens exist.
  • [30星][7m] [Java] bit4woo/burp-api-drops burp suite API 处理http请求和响应的基本流程
  • [29星][2m] [Java] ibey0nd/nstproxy 一款存储HTTP请求入库的burpsuite插件
  • [13星][5y] [Py] enablesecurity/identity-crisis A Burp Suite extension that checks if a particular URL responds differently to various User-Agent headers
  • [11星][3y] [Ruby] crashgrindrips/burp-dump A Burp plugin to dump HTTP(S) requests/responses to a file system
  • [8星][2y] [Py] andresriancho/burp-proxy-search Burp suite HTTP history advanced search
  • [8星][7y] [Java] cyberisltd/post2json Burp Suite Extension to convert a POST request to JSON message, moving any .NET request verification token to HTTP headers if present
  • [8星][3y] [Java] eonlight/burpextenderheaderchecks A Burp Suite Extension that adds Header Checks and other helper functionalities
  • [6星][2y] [Java] stackcrash/burpheaders Burp extension for checking optional headers
  • [6星][2m] [Java] iamaldi/rapid Rapid is a Burp extension that enables you to save HTTP Request / Response to file in a user friendly text format a lot faster.
  • [5星][3y] [Py] floyd-fuh/burp-collect500 Burp plugin that collects all HTTP 500 messages
  • [3星][2y] [Py] externalist/aes-encrypt-decrypt-burp-extender-plugin-example A POC burp extender plugin to seamlessly decrypt/encrypt encrypted HTTP network traffic.

文章

XSS

工具

文章

CSRF

工具

  • [12星][2y] [Java] ah8r/csrf CSRF Scanner Extension for Burp Suite Pro

文章

REST

工具

文章

JWT

工具

文章

Windows

文章

Linux

文章

Apple

文章

Android

工具

  • [282星][3y] [Java] mateuszk87/badintent Intercept, modify, repeat and attack Android's Binder transactions using Burp Suite
  • [12星][21d] [JS] shahidcodes/android-nougat-ssl-intercept It decompiles target apk and adds security exception to accept all certificates thus making able to work with Burp/Charles and Other Tools

文章

Cloud

工具

漏洞

工具

文章

扫描

工具

文章

Fuzz

工具

文章

SQL

工具

文章

日志

工具

Payload

工具

文章

开发与调试

工具

文章

爆破

工具

文章

验证码

工具

文章

编码/解码

工具

文章

认证/登录

工具

  • [350星][20d] [Py] securityinnovation/authmatrix AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.
  • [295星][1m] [Py] quitten/autorize Automatic authorization enforcement detection extension for burp suite written in Jython in order to ease application security people work and allow them perform an automatic authorization tests
  • [74星][6m] [Java] nccgroup/berserko Burp Suite extension to perform Kerberos authentication
  • [40星][7y] [Java] wuntee/burpauthzplugin Burp plugin to test for authorization flaws
  • [9星][1y] [Java] sampsonc/authheaderupdater Burp extension to specify the token value for the Authenication header while scanning.
  • [0星][2y] [Java] insighti/burpamx AMX Authorization Burp Suite Extension

文章

Brida

工具

文章

代理

工具

  • [919星][3y] [Java] summitt/burp-non-http-extension Non-HTTP Protocol Extension (NoPE) Proxy and DNS for Burp Suite.
  • [354星][2y] [Shell] koenbuyens/kalirouter 将 KaliLinux 主机转变为路由器，使用 Wireshark 记录所有的网络流量，同时将 HTTP/HTTPS 流量发送到其他主机的拦截代理（例如 BurpSuite）
  • [318星][1m] [Java] ilmila/j2eescan a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications.
  • [253星][2y] [Java] portswigger/collaborator-everywhere Burp Suite 扩展，通过注入非侵入性 headers 来增强代理流量，通过引起 Pingback 到 Burp Collaborator 来揭露后端系统
  • [230星][1y] [Py] audibleblink/doxycannon 为一堆OpenVPN文件分别创建Docker容器, 每个容器开启SOCKS5代理服务器并绑定至Docker主机端口, 再结合使用Burp或ProxyChains, 构建私有的Botnet
  • [151星][7m] [Py] kacperszurek/burp_wp Find known vulnerabilities in WordPress plugins and themes using Burp Suite proxy. WPScan like plugin for Burp.
  • [89星][8m] [Java] rub-nds/burpssoextension An extension for BurpSuite that highlights SSO messages in Burp's proxy window..
  • [73星][10d] [Py] jiangsir404/pbscan 基于burpsuite headless 的代理式被动扫描系统
  • [71星][4m] [Java] static-flow/burpsuite-team-extension This Burpsuite plugin allows for multiple web app testers to share their proxy history with each other in real time. Requests that comes through your Burpsuite instance will be replicated in the history of the other testers and vice-versa!
  • [49星][2y] [Py] mrschyte/socksmon 使用 BURP 或 ZAP 的 TCP 拦截代理
  • [27星][2y] [Py] mrts/burp-suite-http-proxy-history-converter Python script that converts Burp Suite HTTP proxy history files to CSV or HTML
  • [26星][8m] [Java] static-flow/directoryimporter a Burpsuite plugin built to enable you to import your directory bruteforcing results into burp for easy viewing later. This is an alternative to proxying bruteforcing tools through burp to catch the results.
  • [13星][1y] [Java] retanoj/burpmultiproxy Burpsuite 切换代理插件
  • [11星][4y] [Py] vincd/burpproxypacextension Exemple d'extension Burp permettant d'utiliser les fichiers de configuration de proxy PAC
  • [5星][3y] [Java] mrts/burp-suite-http-proxy-history-viewer Burp Suite HTTP proxy history viewer
  • [5星][3y] [Java] netspi/jsws JavaScript Web Service Proxy Burp Plugin
  • [3星][2y] [Kotlin] pajswigger/filter-options Burp extension to filter OPTIONS requests from proxy history
  • [2星][1y] [Java] coastalhacking/burp-pac Burp Proxy Auto-config Extension

文章

域/子域

工具

  • [383星][1m] [Java] bit4woo/domain_hunter 利用burp收集整个企业、组织的域名（不仅仅是单个主域名）的插件
  • [147星][8m] [Py] codingo/minesweeper A Burpsuite plugin (BApp) to aid in the detection of scripts being loaded from over 23000 malicious cryptocurrency mining domains (cryptojacking).
  • [133星][4m] [Py] prodigysml/dr.-watson a simple Burp Suite extension that helps find assets, keys, subdomains, IP addresses, and other useful information!
  • [17星][4m] [Java] phefley/burp-javascript-security-extension A Burp Suite extension which performs checks for cross-domain scripting against the DOM, subresource integrity checks, and evaluates JavaScript resources against threat intelligence data.

文章

工具

新添加

文档

文章

新添加

贡献

内容为系统自动导出, 有任何问题请提issue

More Repositories

1

awesome-reverse-engineering

Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos)
4,431
star
2

awesome-rat

RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.
1,824
star
3

awesome-network-stuff

Resources about network security, including: Proxy/GFW/ReverseProxy/Tunnel/VPN/Tor/I2P, and MiTM/PortKnocking/NetworkSniff/NetworkAnalysis/etc。More than 1700 open source tools for now. Post incoming.
866
star
4

awesome-forensics

Awesome Forensics Resources. Almost 300 open source forensics tools, and 600 blog posts about forensics.
609
star
5

sec-tool-list

More than 21K security related open source tools, sorted by star count. Both in markdown and json format.
581
star
6

injection-stuff

PE Injection、DLL Injection、Process Injection、Thread Injection、Code Injection、Shellcode Injection、ELF Injection、Dylib Injection, including 400+Tools and 350+posts
499
star
7

windows-security

Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.
483
star
8

anti-av

Resources About Anti-Virus and Anti-Anti-Virus, including 200+ tools and 1300+ posts
425
star
9

android-security

Android Security Resources.
335
star
10

hooking

Resources About Hooking. For All Platforms. Currently 300+ Tools And 600+ Posts.
303
star
11

obfuscation-stuff

Source Code Obfuscation And Binary Obfuscation, Multiple Languages And Multiple Platforms. Including 250+ Tools and 600+ Posts
285
star
12

awesome-security-collection

1000+ Github Security Resource Collection Repos.
263
star
13

cobalt-strike

Resources About Cobalt Strike. 100+ Tools And 200+ Posts.
241
star
14

fuzzing-stuff

Resources About Fuzzing, For Multiple Platforms And All Popular Fuzzers. 500+ Open Source Tools Sorted By Star Count, 800+ Blog Posts Sorted By Publish Time.
233
star
15

shellcode-resources

Resources About Shellcode
203
star
16

awesome-webshell

Awesome webshell collection. Including 150 Github repo, and 200+ blog posts.
165
star
17

DBI-Stuff

Resources About Dynamic Binary Instrumentation and Dynamic Binary Analysis
127
star
18

all-my-collection-repos

All Security Resource Collections Repos That I Published.
116
star
19

anti-debug

C++
115
star
20

persistence

Resources About Persistence, Multiple Platforms. Including ~80 Tools and 300+ Posts.
96
star
21

awesome-honeypot

Awesome Honeypot Resource Collection. Including 250+ Honeypot tools, and 350+ posts about Honeypot.
86
star
22

bypass-uac

C++
56
star
23

sec-daily-2020

2020年发布到阿尔法实验室微信公众号的所有安全资讯汇总
40
star
24

sec-daily-2019

2019年天融信阿尔法实验室在微信公众号发布的所有安全资讯汇总
33
star
25

malware-ioc-hash

Collection of malware ioc hashes from blog posts. A Python script is provided to search through it.
Python
16
star
26

TP-Link-wr940n-vulnerability-details

Details of vulnerability of TP-Link router wr940n
7
star