Skip to content

Latest commit

 

History

History
1517 lines (1063 loc) · 143 KB

Readme.md

File metadata and controls

1517 lines (1063 loc) · 143 KB
Raw

所有收集类项目

BurpSuite

目录

资源收集

工具

文章

Burp组件

Collaborator

工具

文章

Intruder

工具

文章

Repeater

工具

  • [66星][19d] [Java] coreyd97/stepper A natural evolution of Burp Suite's Repeater tool
  • [52星][29d] [Java] portswigger/stepper A natural evolution of Burp Suite's Repeater tool
  • [36星][1m] [Kotlin] typeerror/bookmarks A Burp Suite Extension to take back your repeater tabs
  • [6星][6y] [Perl] allfro/browserrepeater BurpSuite extension for Repeater tool that renders responses in a real browser.

文章

Extender

工具

文章

Macros

工具

文章

Extractor

Spider

平台

Web

WAF

工具

  • [421星][10m] [Java] nccgroup/burpsuitehttpsmuggler A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques
  • [269星][3y] [Java] codewatchorg/bypasswaf Add headers to all Burp requests to bypass some WAF products
  • [8星][7m] [Py] bao7uo/waf-cookie-fetcher WAF Cookie Fetcher is a Burp Suite extension written in Python, which uses a headless browser to obtain the values of WAF-injected cookies which are calculated in the browser by client-side JavaScript code and adds them to Burp's cookie jar. Requires PhantomJS.

文章

HTTP/HTTPS

工具

  • [403星][5m] [Java] nccgroup/autorepeater Automated HTTP Request Repeating With Burp Suite
  • [396星][21d] [Java] portswigger/http-request-smuggler an extension for Burp Suite designed to help you launch HTTP Request Smuggling attack
  • [391星][11d] [Kotlin] portswigger/turbo-intruder a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
  • [240星][2m] [Py] m4ll0k/burpsuite-secret_finder Burp Suite extension to discover apikeys/accesstokens and sensitive data from HTTP response.
  • [128星][15d] [Py] redhuntlabs/burpsuite-asset_discover Burp Suite extension to discover assets from HTTP response.
  • [103星][2y] [Java] gosecure/csp-auditor Burp and ZAP plugin to analyse Content-Security-Policy headers or generate template CSP configuration from crawling a Website
  • [69星][12d] [Java] c0ny1/httpheadmodifer 一款快速修改HTTP数据包头的Burp Suite插件
  • [54星][6m] [Py] gh0stkey/jsonandhttpp Burp Suite Plugin to convert the json text that returns the body into HTTP request parameters.
  • [51星][2y] [Java] netspi/burpextractor A Burp extension for generic extraction and reuse of data within HTTP requests and responses.
  • [33星][12m] twelvesec/bearerauthtoken This burpsuite extender provides a solution on testing Enterprise applications that involve security Authorization tokens into every HTTP requests.Furthermore, this solution provides a better approach to solve the problem of Burp suite automated scanning failures when Authorization tokens exist.
  • [30星][7m] [Java] bit4woo/burp-api-drops burp suite API 处理http请求和响应的基本流程
  • [29星][2m] [Java] ibey0nd/nstproxy 一款存储HTTP请求入库的burpsuite插件
  • [13星][5y] [Py] enablesecurity/identity-crisis A Burp Suite extension that checks if a particular URL responds differently to various User-Agent headers
  • [11星][3y] [Ruby] crashgrindrips/burp-dump A Burp plugin to dump HTTP(S) requests/responses to a file system
  • [8星][2y] [Py] andresriancho/burp-proxy-search Burp suite HTTP history advanced search
  • [8星][7y] [Java] cyberisltd/post2json Burp Suite Extension to convert a POST request to JSON message, moving any .NET request verification token to HTTP headers if present
  • [8星][3y] [Java] eonlight/burpextenderheaderchecks A Burp Suite Extension that adds Header Checks and other helper functionalities
  • [6星][2y] [Java] stackcrash/burpheaders Burp extension for checking optional headers
  • [6星][2m] [Java] iamaldi/rapid Rapid is a Burp extension that enables you to save HTTP Request / Response to file in a user friendly text format a lot faster.
  • [5星][3y] [Py] floyd-fuh/burp-collect500 Burp plugin that collects all HTTP 500 messages
  • [3星][2y] [Py] externalist/aes-encrypt-decrypt-burp-extender-plugin-example A POC burp extender plugin to seamlessly decrypt/encrypt encrypted HTTP network traffic.

文章

XSS

工具

文章

CSRF

工具

  • [12星][2y] [Java] ah8r/csrf CSRF Scanner Extension for Burp Suite Pro

文章

REST

工具

文章

JWT

工具

文章

Windows

文章

Linux

文章

Apple

文章

Android

工具

  • [282星][3y] [Java] mateuszk87/badintent Intercept, modify, repeat and attack Android's Binder transactions using Burp Suite
  • [12星][21d] [JS] shahidcodes/android-nougat-ssl-intercept It decompiles target apk and adds security exception to accept all certificates thus making able to work with Burp/Charles and Other Tools

文章

Cloud

工具

漏洞

工具

文章

扫描

工具

文章

Fuzz

工具

文章

SQL

工具

文章

日志

工具

Payload

工具

文章

开发与调试

工具

文章

爆破

工具

文章

验证码

工具

文章

编码/解码

工具

文章

认证/登录

工具

  • [350星][20d] [Py] securityinnovation/authmatrix AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.
  • [295星][1m] [Py] quitten/autorize Automatic authorization enforcement detection extension for burp suite written in Jython in order to ease application security people work and allow them perform an automatic authorization tests
  • [74星][6m] [Java] nccgroup/berserko Burp Suite extension to perform Kerberos authentication
  • [40星][7y] [Java] wuntee/burpauthzplugin Burp plugin to test for authorization flaws
  • [9星][1y] [Java] sampsonc/authheaderupdater Burp extension to specify the token value for the Authenication header while scanning.
  • [0星][2y] [Java] insighti/burpamx AMX Authorization Burp Suite Extension

文章

Brida

工具

文章

代理

工具

  • [919星][3y] [Java] summitt/burp-non-http-extension Non-HTTP Protocol Extension (NoPE) Proxy and DNS for Burp Suite.
  • [354星][2y] [Shell] koenbuyens/kalirouter 将 KaliLinux 主机转变为路由器，使用 Wireshark 记录所有的网络流量，同时将 HTTP/HTTPS 流量发送到其他主机的拦截代理（例如 BurpSuite）
  • [318星][1m] [Java] ilmila/j2eescan a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications.
  • [253星][2y] [Java] portswigger/collaborator-everywhere Burp Suite 扩展，通过注入非侵入性 headers 来增强代理流量，通过引起 Pingback 到 Burp Collaborator 来揭露后端系统
  • [230星][1y] [Py] audibleblink/doxycannon 为一堆OpenVPN文件分别创建Docker容器, 每个容器开启SOCKS5代理服务器并绑定至Docker主机端口, 再结合使用Burp或ProxyChains, 构建私有的Botnet
  • [151星][7m] [Py] kacperszurek/burp_wp Find known vulnerabilities in WordPress plugins and themes using Burp Suite proxy. WPScan like plugin for Burp.
  • [89星][8m] [Java] rub-nds/burpssoextension An extension for BurpSuite that highlights SSO messages in Burp's proxy window..
  • [73星][10d] [Py] jiangsir404/pbscan 基于burpsuite headless 的代理式被动扫描系统
  • [71星][4m] [Java] static-flow/burpsuite-team-extension This Burpsuite plugin allows for multiple web app testers to share their proxy history with each other in real time. Requests that comes through your Burpsuite instance will be replicated in the history of the other testers and vice-versa!
  • [49星][2y] [Py] mrschyte/socksmon 使用 BURP 或 ZAP 的 TCP 拦截代理
  • [27星][2y] [Py] mrts/burp-suite-http-proxy-history-converter Python script that converts Burp Suite HTTP proxy history files to CSV or HTML
  • [26星][8m] [Java] static-flow/directoryimporter a Burpsuite plugin built to enable you to import your directory bruteforcing results into burp for easy viewing later. This is an alternative to proxying bruteforcing tools through burp to catch the results.
  • [13星][1y] [Java] retanoj/burpmultiproxy Burpsuite 切换代理插件
  • [11星][4y] [Py] vincd/burpproxypacextension Exemple d'extension Burp permettant d'utiliser les fichiers de configuration de proxy PAC
  • [5星][3y] [Java] mrts/burp-suite-http-proxy-history-viewer Burp Suite HTTP proxy history viewer
  • [5星][3y] [Java] netspi/jsws JavaScript Web Service Proxy Burp Plugin
  • [3星][2y] [Kotlin] pajswigger/filter-options Burp extension to filter OPTIONS requests from proxy history
  • [2星][1y] [Java] coastalhacking/burp-pac Burp Proxy Auto-config Extension

文章

域/子域

工具

  • [383星][1m] [Java] bit4woo/domain_hunter 利用burp收集整个企业、组织的域名（不仅仅是单个主域名）的插件
  • [147星][8m] [Py] codingo/minesweeper A Burpsuite plugin (BApp) to aid in the detection of scripts being loaded from over 23000 malicious cryptocurrency mining domains (cryptojacking).
  • [133星][4m] [Py] prodigysml/dr.-watson a simple Burp Suite extension that helps find assets, keys, subdomains, IP addresses, and other useful information!
  • [17星][4m] [Java] phefley/burp-javascript-security-extension A Burp Suite extension which performs checks for cross-domain scripting against the DOM, subresource integrity checks, and evaluates JavaScript resources against threat intelligence data.

文章

工具

新添加

文档

文章

新添加

贡献

内容为系统自动导出, 有任何问题请提issue