CIP Cyber

Next-gen BurpSuite Penetration Testing Tool

Table of Contents

Welcome to the next generation of web application penetration testing – using WebKit to own the web.
BurpKit is a BurpSuite plugin which helps in assessing complex web apps that render the contents of
their pages dynamically. It also provides a bi-directional JavaScript bridge API which allows users
to create quick one-off BurpSuite plugin prototypes which can interact directly with the DOM and
Burp’s extender API.

System Requirements

BurpKit has the following system requirements:

  • Oracle JDK >=8u50 and <9 (Download)
  • At least 4GB of RA

Installation

Installing BurpKit is simple:

  1. Download the latest prebuilt release from the GitHub releases page.
  2. Open BurpSuite and navigate to the Extender tab.
  3. Under Burp Extensions click the Add button.
  4. In the Load Burp Extension dialog, make sure that Extension Type is set to Java and click the Select file … button under Extension Details.
  5. Select the BurpKit-<version>.jar file and click Next when done.

If all goes well, you will see three additional top-level tabs appear in BurpSuite:

  1. BurpKitty: a courtesy browser for navigating the web within BurpSuite.
  2. BurpScript IDE: a lightweight integrated development environment for writing JavaScript-based BurpSuite plugins and other things.
  3. Jython: an integrated python interpreter console and lightweight script text editor.

BurpScript

BurpScript enables users to write desktop-based
JavaScript applications as well as BurpSuite extensions using the
JavaScript scripting language. This is achieved by injecting two new
objects by default into the DOM on page load:

  1. burpKit: provides numerous features including file system I/O support and easy JS library injection.
  2. burpCallbacks: the JavaScript equivalent of the IBurpExtenderCallbacks interface in Java with a few slight modifications.

Take a look at the examples folder for more information.

CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

Do Hackers Really use Metasploit? NO!

Undoubtedly, Metasploit is one of the most organized, well-developed tools in the pen-testers toolbox. But, do hackers use it? Some of them, but not the

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings