Awesome Burp Extensions

A curated list of awesome Burp Extensions for bug hunter. groups by vulnerability types

Broken Access Control

Autorize - One Burp extension that kept cropping up here was Autorize, by Barak Tawily. Autorize helps you to test for authentication vulnerabilities, and can save you a lot of time in doing this.

Race conditions

Turbo Intruder : Turbo Intruder, by PortSwigger Research's James Kettle was another popular entry. Turbo Intruder enables automated attacks even where extreme speed or complexity is required.

Sensitive Data Exposure

JS Link Finder - Burp Extension for a passively scanning JavaScript files for endpoint links.

SQL/NoSQL Injection

SQLiPy Sqlmap Integration - This extension integrates Burp Suite with SQLMap.

Burp NoSQLi Scanner - NoSQL Injection scans for Burp

API Scanner

InQL Scanner - A Comprehensive Burp Extension for GraphQL Security Testing.

Logger++ is a multithreaded logging extension for Burp Suite.

web cache poisoning

Param Miner - This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities.

Insecure File Uploads

Upload Scanner - A Burp Suite Pro extension to do security tests for HTTP file uploads.