Burp MCP edition v1.0.2

OWASP SecretSifter Burp MCP edition v1.0.2: false-positive reduction and new INFORMATION-tier detection. Adds multi-provider AI triage and a local MCP server on top of the Burp Suite extension. Compatible with Burp Suite 2024.7+ (Pro and Community).

Install

1. Download secretsifter-mcp-1.0.2.jar from the Assets section below
2. Open Burp Suite → Extensions → Installed → Add
3. Set Extension type to Java, browse to the JAR, click Next
4. A SecretSifter MCP tab appears in the main tab bar

Reproducible build verification

Anyone can rebuild this JAR from source and get a byte-identical file:

git clone https://github.com/OWASP/SecretSifter.git
cd SecretSifter && git checkout burp-mcp-v1.0.2
cd burp-mcp && ./gradlew shadowJar
shasum -a 256 build/libs/secretsifter-mcp-1.0.2.jar

SHA-256: 0919374feab857062f7b7ac8d047ff3b89f6e9446fead10f6e285a03097b80a7

---

What's changed since v1.0.1

False-positive reduction

• i18n / NLS label strings suppressed — values containing 2+ non-ASCII codepoints (Japanese, Thai, Korean, etc.) are now recognised as localised UI strings and not reported. Previously, key names such as certificatePasswordRequired or successfulSecretCreated caused SS to flag translated UI labels as credential findings.
• Form-field required markers suppressed — values that are purely alphabetic (including extended-Latin characters) with an optional trailing asterisk are now suppressed. Catches patterns like Certifikatadgangskode* (Danish), Certifikatlösenord* (Swedish), Zertifikatskennwort* (German), Sertifikatpassord* (Norwegian).

New INFORMATION-tier detection

• X.509 certificate thumbprint — detects SHA-1 fingerprints (40-character hex values) in keys containing thumbprint. Certificate thumbprints are public by design but reveal which certificates are in use for signing/TLS. Fires on all scan tiers; previously only reachable via FULL-tier generic KV scanner at incorrect HIGH severity.
• Vault secret reference ID — detects UUID values in keys named *SecretId or *PasswordSecretId. These are pointers to where credentials are stored in vault systems (Azure Key Vault, CyberArk, HashiCorp Vault) rather than credentials themselves, but they expose vault topology and secret naming conventions. Previously suppressed entirely.

Burp Suite extension v1.0.3

OWASP SecretSifter Burp Suite extension v1.0.3: false-positive reduction and new INFORMATION-tier detection. Compatible with Burp Suite 2024.7+ (Pro and Community).

Install

1. Download secretsifter-1.0.3.jar from the Assets section below
2. Open Burp Suite → Extensions → Installed → Add
3. Set Extension type to Java, browse to the JAR, click Next
4. A Secret Sifter tab appears in the main tab bar

Reproducible build verification

Anyone can rebuild this JAR from source and get a byte-identical file:

git clone https://github.com/OWASP/SecretSifter.git
cd SecretSifter && git checkout burp-extension-v1.0.3
cd burp-extension && ./gradlew shadowJar
shasum -a 256 build/libs/secretsifter-1.0.3.jar

SHA-256: d80ead4f44a0fcd533fc09964fcccccf3a668a23adacc5a19a692e5aef78b262

---

What's changed since v1.0.2

False-positive reduction

• i18n / NLS label strings suppressed — values containing 2+ non-ASCII codepoints (Japanese, Thai, Korean, etc.) are now recognised as localised UI strings and not reported. Previously, key names such as certificatePasswordRequired or successfulSecretCreated caused SS to flag translated UI labels as credential findings.
• Form-field required markers suppressed — values that are purely alphabetic (including extended-Latin characters) with an optional trailing asterisk are now suppressed. Catches patterns like Certifikatadgangskode* (Danish), Certifikatlösenord* (Swedish), Zertifikatskennwort* (German), Sertifikatpassord* (Norwegian).

New INFORMATION-tier detection

• X.509 certificate thumbprint — detects SHA-1 fingerprints (40-character hex values) in keys containing thumbprint. Certificate thumbprints are public by design but reveal which certificates are in use for signing/TLS. Fires on all scan tiers; previously only reachable via FULL-tier generic KV scanner at incorrect HIGH severity.
• Vault secret reference ID — detects UUID values in keys named *SecretId or *PasswordSecretId. These are pointers to where credentials are stored in vault systems (Azure Key Vault, CyberArk, HashiCorp Vault) rather than credentials themselves, but they expose vault topology and secret naming conventions. Previously suppressed entirely.