Hey there. In this post, we will be talking about some of the most popular Burspuite extensions and the different features about them. If you have been doing penetration testing for some time you must be already knowing that Burpsuite is the best tool a web application penetration tester can have. There is already a blog post on Burpsuite extensions. You should read it from here. There are many extensions in the BApp Store, some of them are available for free version while there are many that are only available for the Pro version. We already know that the inbuilt features provided in Burpsuite serve most of the purpose but these extensions go one step further in identifying some critical issues. So let’s see our three favorite Burpsuite extensions and understand how to use them.

Active Scan++ (Available for Pro version)

This is one of the most popular extensions in Burpsuite. If you have used the Pro version, you must be already knowing that Burp Pro comes with scanning(Both Active and Passive) scanning capabilities. Now, this extension further extends the capabilities of scanning and help identify some awkward behavior that can be of particular interest to testers.

This extension is only applicable for users having Burpsuite’s Pro Version because it will just start running when you do a simple Active scan on the target.

How to install Active Scan++:

1. First, you need to install Jython 2.5 or higher standalone version. Download the standalone version from here. The latest version at the time of writing this is 2.7.0.
2. Open Burpsuite. Go to Extender -> Options.
3. In the Python Environment, select the file for the location of Jython standalone Jar file which you downloaded earlier. See the screenshot below,

1. Now again go to the Active Scan++ option in BApp store, you will see that the Install option is now available. Just click Install and the extension will be installed on your Burpsuite.

One thing to mention, you won’t see the Active Scan++ tab as you see for the other extensions because it will be automatically added to the Active scanning of Burpsuite. SO to run it, you just need to do a normal active scan and it will add the issues which it finds.

‍

Particular issues that it takes care of:

Active Scan++ will notify you of issues like XML input handling. Or if the input you submitted is being treated as a code rather than a plain text, for example, if you submit 5*5 and it outputs 25 instead of 5*5, and also checks for potential host header injection attacks.

There is also a manual way to install Active Scan++. See this official Github page for instructions on that.

JSON Beautifier: (Available for Free version)

This is one of the extensions, we have been using pretty much lately. Ever thought how easy it could have been if you could somehow see the JSON content in a better way rather the crunched stuff you see when there is a JSON Response. Sometimes, it’s so difficult to understand the content that many people copy it into a text editor and then arrange it to understand the syntax properly.

If you are one of those, and you think that there should be a way to see these JSON Responses in an arranged manner, then hey, this extension is perfect for you.

How to install JSON Beautifier:

JSON Beautifier is available for free version also so do give it a try.

1. Go to Extender -> BApp Store. You will see the JSON Beautifier extension there.
2. Just Hit Install. Nothing special to do like that in Active Scan++.

See these two pictures of before and after. The response in the picture is small but many times you will see Responses which are 50-60 lines long. So just check the after use image and see for yourself that how good this will be if arranged because you will be able to properly see the JSON content and can look for what you want.

• Basically for beautifying and arranging JSON content.

Reflected Parameters: (Available for Pro users)

This is also one of the most popular extensions for BurpSuite.

How to install Reflected Parameters:

• You need to have Java version 7 or greater installed as a prerequisite of installing this extension. So, install Java at first.
• After that, Go to Extender -> BApp Store.
• Go to Reflected Parameters Extension and simply Install.

Particular issues that it takes care of:

As documented in the official page, this extension

• Monitors traffic and looks for request parameter values (longer than 3 characters) that are reflected in the response.
• The extension monitors in-scope requests made by the Proxy and Spider tools. When sending an item to the Scanner, you can choose to scan all reflected parameters or only one reflected parameter.

We haven’t used this extension too much but yeah it is definitely popular and worth trying. It can also help you to get XSS issues in a web application so try it once.

So this was all for this post. There are a whole lot of extensions available in the store and testers are adding more and more every day. If you want to add an extension yourself, you have the option to do so. Several people may have different opinions about the extensions they love. If you are one of those and want us to add any more awesome extensions, do comment below and we will be more than happy to include it in this list.

Until then, start using Burpsuite and Keep Hacking.:)

‍