Quick Start

Quick Start

This page covers the Burp editions. If you have not installed yet, see Installation.

Passive scanning

1. Load the extension. A Secret Sifter tab appears (SecretSifter MCP for the MCP edition).
2. Browse your target through Burp's browser or proxy.
3. SecretSifter scans responses as they pass through Burp.
4. View findings:
   • Burp Professional: Dashboard, Issue Activity, and the site map issues.
   • Any edition: open a request in Proxy history and select the SecretSifter tab on the response.

When the extension loads, it also scans what is already in Target, Site map, so findings from earlier browsing appear.

Bulk Scan

1. Open the Bulk Scan tab inside the Secret Sifter tab.
2. Paste one URL per line, or click Import File… (.txt or .csv). To scan a HAR capture directly, click Scan HAR….
3. Choose a Scan Tier (FULL is the default) and a thread count.
4. Click Start Scan. Results fill the table as the scan runs.
5. Export with Export ZIP, then All-in-one Report or Per-Domain Reports (ZIP), or with Export, then Export JSON.

The HTML report inside the exported ZIP is a single self-contained file you can attach to a ticket:

To scan what Burp has already captured, click Scan Site Map on the Bulk Scan tab.

Rescan for Secrets

In Proxy history, Repeater, Logger or the site map, right-click a request and choose Extensions, SecretSifter (SecretSifter Burp MCP in the MCP edition), Rescan for Secrets. SecretSifter rescans the site-map entries for the selected host.