BurpSuite'swebvulnerabilityscanner
Productcomparison
What'sthedifferencebetweenProandEnterpriseEdition
Downloads
DownloadthelatestversionofBurpSuite.
Thatsaid,extensionsrangefromafewdozenlinesofcodetoseveralthousand.Theydon'tneedtobelargeorsophisticatedtobeinvaluable!Someofourfavoriteextensionsareunderahundredlines.
WhenauserscrollsthroughtheBAppStore,theywillbedrawntoextensionsthatsolveissuestheyareencountering.Tocaptureattention,thenameneedstoclearlydescribewhattheextensiondoes.Whileplayfulnameslike'PsychoPATH'havebeenusedinthepast,wenowencouragenamestobedescriptive.Youcanalsoprovideaone-linesummarythatappearsinthelist(webonly),aswellasamoredetaileddescription.
AmajorbenefitoftheBAppStoreisoneclickinstallation.Ifyourextensionincludesalldependencies,itismucheasierforuserstogetstarted.Doingthisalsoavoidsversionmismatches-whereanunderlyingtoolisupgraded,buttheBAppisnot.
Acommonmistakeisperformingslowoperations-suchasHTTPrequests-intheSwingEventDispatchThread.ThiscausesBurptoappearunresponsive,asthewholeGUImustwaituntiltheslowoperationcompletes.Tomaintainresponsiveness,performslowoperationsinabackgroundthread.Inaddition,avoidslowoperationsinprocessProxyMessageandprocessHttpMessage.Toavoidconcurrencyissues,protectshareddatastructureswithlocks,andtakecaretoavoiddeadlocks.BeawarethatBurpdoesnotcatchandreportexceptionsinbackgroundthreads.Toreportbackgroundexceptions,surroundthefullthreadoperationwithatry/catchblockandwriteanystacktracestotheextensionerrorstream.
Whenanextensionunloads,itneedstoreleaseallresources.Burpresources,likeITaborIContextMenuFactoryarereleasedautomatically.However,otherresourcesmaynotbe.Ifsuchresourcesarecreated,theextensionneedstoimplementIExtensionStateListener.Themostcommonexampleisbackgroundthreads;itisimportantthatbackgroundthreadsareterminatedinextensionUnloaded.
WhenmakinganHTTPrequest-tothetarget,orotherwise-it'spreferabletouseBurp'smakeHttpRequest,insteadoflibrarieslikejava.net.URL.ThissendstherequestthroughtheBurpcore,sosettingslikeupstreamproxiesandsessionhandlingruleswillbeobeyed.ManyusersareonacorporatenetworkthatonlyallowsInternetaccessthroughaproxy.Inaddition,avoidperforminganycommunicationtothetargetfromwithindoPassiveScan.
SomeBurpusersneedtooperatefromhigh-securitynetworkswithoutInternetaccess.Tosupporttheseusers,extensionsthatcontactanonlineservicetoreceivevulnerabilitydefinitionsorotherdatashouldincludeacopyofrecentdefinitions,asafallbackfordisconnectednetworks.
Someusersworkwithverylargeprojects.Tosupportsuchusers,avoidkeepinglong-termreferencestoobjectspassedtofunctionslikeprocessHttpMessageordoActiveScan.Ifyouneedtokeepalong-termreferencetoanHTTPmessage,usesaveBuffersToTempFiles.Also,takecarewithgetSiteMapandgetProxyHistoryasthesecanreturnhugeresults.SomesubmissionshavecalledgetProxyHistoryatstartupwhichresultsinextremelyslowstartupwithlargeprojects.
IfanextensioncreatesGUIelements,suchaspopupwindowsormessages,theseshouldbechildrenofthemainBurpFrame.Thisisparticularlyimportantwhenusershavemultiplemonitors,tomakesurepopupsappearonthecorrectone.TogettheBurpFrame,useFrame.getFramestogetallframes,andsearchforaframewithatitlecontaining"BurpSuite".
ExtensionsoriginallyneededtoincludetheJavainterfacefiles(IBurpExtender.java,etc.)forcompilationtowork,whichcluttersthesourcecode.Withnewerbuildtools-MavenandGradle-thisisnowunnecessary.Instead,referencetheburp-extender-apiartifactwhichisinthenet.portswiggergroup.Ifyou’restartinganewprojectwerecommendusingGradle.