Essential Extensions

High-speed HTTP fuzzing engine that bypasses Community edition's 1 req/sec throttle. Essential for brute-force attacks and massive parameter fuzzing.

Attack speed limited only by your CPU/network, not Burp throttle.

Advanced logging with filtering, regex search, color highlighting, and grep capabilities. Much more powerful than the built-in HTTP history.

Set filters to capture only relevant traffic; can handle millions of entries without slowing down.

Automated authorization testing. Detects IDOR and privilege escalation by automatically testing multiple user contexts on the same endpoint.

Configure two or more user sessions; Autorize tests if lower-priv user can access higher-priv resources.

Decode, modify, and sign JSON Web Tokens. Test for "none" algorithm, weak secrets, and token tampering vulnerabilities.

Use the "Sign" tab to re-sign tampered tokens with your own secret if you discover weak signing keys.

Enhances Burp's built-in scanner with additional vulnerability checks not included in Pro by default.

Community edition users: this partially replaces the missing automated scanner.

Automatically discovers hidden parameters (including HTTP headers) by guessing common names. Finds parameters that affect application behavior.

Use wordlists like 'params.txt' from SecLists to attack hidden parameters like ?admin=true or X-Forwarded-For.

Scans for outdated and vulnerable JavaScript libraries in web pages. Identifies known CVEs in client-side libraries.

Great for finding jQuery, Angular, React vulnerabilities during spidering.

Comprehensive JWT analysis: decode, verify signatures, test "none" algorithm, weak secrets, and more.

Different from JWT Editor — this extension focuses on analysis; JWT Editor on modification.

Advanced encoding/decoding with custom tags. Chains multiple transforms and creates reusable payload templates.

Create custom payloads that automatically apply complex encoding chains before sending.

Enhanced Repeater for rapid parameter enumeration. Batches multiple requests and processes responses automatically.

Alternative to Intruder for some fuzzing tasks with more flexible payload processing.

Analyzes SSL/TLS configuration, prints cipher suites, certificate details, and security grades.

Quickly assess SSL strength without leaving Burp.

Injects Collaborator payloads into all out-of-band detection points automatically during scans.

Detects blind SSRF, XXE, and other OAST vulnerabilities without manual injection.