fbpx

Next-gen BurpSuite Penetration Testing Tool

Welcome to the next generation of web application penetration testing – using WebKit to own the web.
BurpKit is a BurpSuite plugin which helps in assessing complex web apps that render the contents of
their pages dynamically. It also provides a bi-directional JavaScript bridge API which allows users
to create quick one-off BurpSuite plugin prototypes which can interact directly with the DOM and
Burp’s extender API.

System Requirements

BurpKit has the following system requirements:

  • Oracle JDK >=8u50 and <9 (Download)
  • At least 4GB of RA

Installation

Installing BurpKit is simple:

  1. Download the latest prebuilt release from the GitHub releases page.
  2. Open BurpSuite and navigate to the Extender tab.
  3. Under Burp Extensions click the Add button.
  4. In the Load Burp Extension dialog, make sure that Extension Type is set to Java and click the Select file … button under Extension Details.
  5. Select the BurpKit-<version>.jar file and click Next when done.

If all goes well, you will see three additional top-level tabs appear in BurpSuite:

  1. BurpKitty: a courtesy browser for navigating the web within BurpSuite.
  2. BurpScript IDE: a lightweight integrated development environment for writing JavaScript-based BurpSuite plugins and other things.
  3. Jython: an integrated python interpreter console and lightweight script text editor.

BurpScript

BurpScript enables users to write desktop-based
JavaScript applications as well as BurpSuite extensions using the
JavaScript scripting language. This is achieved by injecting two new
objects by default into the DOM on page load:

  1. burpKit: provides numerous features including file system I/O support and easy JS library injection.
  2. burpCallbacks: the JavaScript equivalent of the IBurpExtenderCallbacks interface in Java with a few slight modifications.

Take a look at the examples folder for more information.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What Makes ICS/OT Infrastructure Vulnerable?

Infrastructure security for operational technologies (OT) and industrial control systems (ICS) varies from IT security in several ways, with the inverse confidentiality, integrity, and...

Everything You Must Know About IT/OT Convergence

What is an Operational Technology (OT)? Operational technology (OT) is a technology that primarily monitors and controls physical operations. It can automate and control machines,...

Understand the OT Security and Its Importance

This article discusses OT security and why it is essential for protecting industrial systems from cyberattacks. We will also discuss common control objectives that can...

What is Deepfake, and how does it Affect Cybersecurity?

Producing deepfake is easy. It is hard to detect. They operate with a description of reality rather than reality itself (e.g., a video). Any...