# BurpSuite | PowerFul Plugins **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools\ **Created:** [December 9, 2020, 12:38pm UTC](https://onehack.st/t/burpsuite-powerful-plugins/165607 "2020-12-09T12:38:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\ **Post date:** [December 9, 2020, 12:38pm UTC](https://onehack.st/t/burpsuite-powerful-plugins/165607/1 "2020-12-09T12:38:00Z")
![image](https://onehack.st/uploads/default/original/3X/6/c/6cde2d67b72fffa914a9f7ee078ecf2f7c6180d2.png) ## Burp Plugins ### [ActiveScan++](https://github.com/albinowax/ActiveScanPlusPlus) ActiveScan++ extends Burp Suite’s active and passive scanning capabilities. ### [AMFDSer-ngng](https://github.com/nccgroup/AMFDSer-ngng) A Burp Extender plugin, that will take deserialized AMF objects and encode them in XML using the Xtream library ### [Airachnid-Burp-Extension](https://github.com/SpiderLabs/Airachnid-Burp-Extension) A Burp Extension to test applications for vulnerability to the Web Cache Deception attack ### [AWS-Extender](https://github.com/VirtueSecurity/aws-extender) BurpSuite extension to identify and test S3 buckets as well as Google Storage buckets and Azure Storage containers for common misconfiguration issues using the boto/boto3 SDK library ### [BountyHelper](https://github.com/redr2e/bountyHelper) Burp plugin to help bug hunters identify possible parameters vulnerable to XSS reflected attacks ### [BurpAuthzPlugin](https://github.com/wuntee/BurpAuthzPlugin) Burp plugin to test for authorization flaws ### [BurpHMAC](https://github.com/malcomvetter/BurpHmac) An HMAC authentication header plugin for Burp Proxy, written in Python. ### [Burp-Hunter](https://github.com/mystech7/Burp-Hunter) XSS Hunter Burp Plugin ### [BurpJDSer-ng-edited](https://github.com/federicodotta/BurpJDSer-ng-edited) Burp Suite plugin that allow to deserialize Java objects and convert them in an XML format. Unpack also gzip responses. Based on BurpJDSer-ng of omercnet. ### [BurpNotesExtension](https://github.com/SpiderLabs/BurpNotesExtension) Burp Notes Extension is a plugin for Burp Suite that adds a Notes tab. The tool aims to better organize external files that are created during penetration testing. ### [Burp-OAUTH](https://github.com/dnet/burp-oauth) OAuth plugin for Burp Suite Extender ### [BurpPlugins](https://github.com/singleghost/BurpPlugins) This repository contains - Base32Decode - assassin - dictionary\_generator - unicode\_decode - bing\_search ### [Burp-ysoserial](https://github.com/summitt/burp-ysoserial) YSOSERIAL Integration with burp suite ### [CSRF-PoC-plugin](https://github.com/HanLee/Burp-Suite-CSRF-PoC-plugin) Creates a CSRF PoC with in a jiffy ### [convertJavaToPython](https://github.com/artran/burp-plugins) Tool to convert the Java Interface definitions into Python definitions to make PyCharm (etc) a little quieter. ### [CSP-Bypass](https://github.com/moloch--/CSP-Bypass) A Burp Plugin for Detecting Weaknesses in Content Security Policies ### [Deflate-Burp-Plugin](https://github.com/GDSSecurity/Deflate-Burp-Plugin) The Deflate Burp Plugin is a plug-in for Burp Proxy (it implements the IBurpExtender interface) that decompresses HTTP response content in the ZLIB (RFC1950) and DEFLATE (RFC1951) compression formats. ### [DSXS-SQLMap-Plugin](https://github.com/arirubinstein/Burp-DSXS-Sqlmap-Plugin) Integration Plugin for stamparam’s DSXS scanner ### [EasyCSRF](https://github.com/0ang3el/EasyCSRF) Helps to find weak CSRF-protection in WebApp which can be easily bypassed ### [G2Plugins](https://github.com/gheld/burp-g2plugins) Plugin Collection for BURP related to black-box pentesting ### [GWT-Scan](https://github.com/augustd/burp-suite-gwt-scan) Burp Suite plugin identifies insertion points for GWT (Google Web Toolkit) requests ### [Handy Collaborator](https://github.com/federicodotta/HandyCollaborator) Burp Suite plugin created for using Collaborator tool during manual testing ### [HeaderScan](https://github.com/drk1wi/HeaderScan) HeaderScan is a Burp Pro plugin that extends a scope of an automated web scan with some very promising entry points. ### [Headless-Burp](https://github.com/NetsOSS/headless-burp) Provides a suite of Burp extensions and a maven plugin to automate security tests using BurpSuite. ### [Hiccupy](https://github.com/iSECPartners/hiccupy) Jython binding for Burp to facilitate realtime traffic analysis and modification using simple plugins. ### [HTTP-Script-Generator](https://github.com/h3xstream/http-script-generator) ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks). ### [IBM-WebSphere-Portlet-Decoder](https://github.com/AccuvantLabs-Appsec/burp-IBM-WebSphere-Portlet-Decoder) BurpSuite plugin for decoding IBM WebSphere Portlet States. ### [ImageLocationScanner](https://github.com/veggiespam/ImageLocationScanner) Scan for GPS location exposure in images with this Burp & ZAP plugin. ### [Image-Size](https://github.com/silentsignal/burp-image-size) Image size issues plugin for Burp Suite. ### [Image-Metadata](https://github.com/h3xstream/burp-image-metadata) Burp and ZAP plugin that display image metadata (JPEG Exif or PNG text chunk). ### [J2EEScan](https://github.com/ilmila/J2EEScan) J2EEScan is a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications. ### [Java-Deserialization-Scanner](https://github.com/federicodotta/Java-Deserialization-Scanner) All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities. ### [JDSer-ngng](https://github.com/nccgroup/JDSer-ngng) A Burp Extender plugin, that will deserialized java objects and encode them in XML using the Xtream library. ### [JSON\_Beautifier](https://github.com/4ARMED/burp_plugins/) This plugin provides a JSON tab with beautified representation of the request/response. ### [JSON-Array](https://github.com/silentsignal/burp-json-array) JSON Array issues plugin for Burp Suite. ### [Luhn-Payload-Processor](https://github.com/EnableSecurity/burp-luhn-payload-processor) A plugin for Burp Suite Pro to work with attacker payloads and automatically generate check digits for credit card numbers and similar numbers that end with a check digit generated using the Luhn algorithm or formula (also known as the “modulus 10” or “mod 10” algorithm). ### [MailPhisher](https://github.com/shpendk/mailphisher) A burp plugin written in python to check for email content injection vulnerabilities. ### [Minesweeper](https://github.com/codingo/Minesweeper) A burp plugin to aid in the detection of scripts being loaded from over 3200 malicious cryptocurrency mining domains (cryptojacking). ### [MultiDEC](https://github.com/aglane/BurpMultiDEC) A multi-tabbed encoder/decoder plugin. ### [PassiveXssScan](https://github.com/jkadijk/burp-plugins) Searches for parameters that are reflected back to make searching for reflected XSS just a bit easier/faster. ### [PwnBack](https://github.com/k4ch0w/PwnBack/) Burp Extender plugin that generates a sitemap of a website using Wayback Machine ### [PyBurp](https://github.com/icewall/PyBurp) Jython Plugins and Plugins Manager for Burp. ### [Requests](https://github.com/silentsignal/burp-requests) Copy as requests plugin for Burp Suite. Copies selected request(s) as Python requests invocation. ### [RequestUtils](https://github.com/frohoff/burp-plugin-requestutils) Plugin for manipulating requests in PortSwigger Burp Suite Pro v1.5+. ### [RhinAuditor](https://github.com/h3xstream/rhinauditor) Static analyzer for JavaScript aiming for security bugs. (ZAP/Burp plugin) ### [SAML](https://github.com/chrismsnz/burp_saml) Plugin for Burp to allow viewing and editing of intercepted SAML messages. ### [Sentinel](https://github.com/dobin/BurpSentinel) GUI Burp Plugin to ease discovering of security holes in web applications. ### [SessionAuthTool](https://github.com/thomaspatzke/Burp-SessionAuthTool) Burp plugin which supports in finding privilege escalation vulnerabilities. ### [SQLdude](https://github.com/faffi/sqldude) Burp plugin to turn requests into sqlmap commands. ### [SQLiPy](https://github.com/codewatchorg/sqlipy) SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API. ### [WebSphere-Portlet-State-Decoder](https://github.com/faffi/WebSphere-Portlet-State-Decoder) WebSphere Portlet State Decoder plugin for Burp. ### [WCFDSer-ngng](https://github.com/nccgroup/WCFDSer-ngng) A Burp Extender plugin, that will make binary soap objects readable and modifiable. ### [WSDLWizard](https://github.com/SmeegeSec/WSDLWizard) WSDL Wizard is a Burp Suite plugin written in Python to detect current and discover new WSDL (Web Service Definition Language) files. ### [xssValidator](https://github.com/nVisium/xssValidator) Burp intruder extender that is designed for automation and validation of XSS vulnerabilities. ## Misc ### [carbonator](https://github.com/integrissecurity/carbonator) Integris Security Carbonator - The Burp Suite Pro extension that automates scope, spider & scan from the command line. Carbonator helps automate the vulnerability scanning of web applications. Either 1 or 100 web applications can be scanned by issuing a single command. Carbonator is now available from within Burp Suite Pro through the BApp Store. ### [Dradis-Burp](https://github.com/dradis/dradis-burp) Burp Suite plugin for the Dradis Framework [http://dradisframework.org](http://dradisframework.org/) ### [Hiccup](https://github.com/zynga/hiccup) Hiccup is a framework that allows the Burp Suite (a web application security testing tool, [http://portswigger.net/burp/](http://portswigger.net/burp/)) to be extended and customized, through the interface provided by Burp Extender ([http://portswigger.net/burp/extender/](http://portswigger.net/burp/extender/)). Its aim is to allow for the development and integration of custom testing functionality into the Burp tool using Python request/response handler plugins. `Source: GutHub` ## **Enjoy!** ❤