Hi!<\/p>\n
Last Thursday, as part of the Burp Extensibility Month<\/a> on the PortSwigger<\/span> Discord server<\/a>, I gave a talk on topic \u201cRestoring Testability: Handling Complex Scenarios in Burp Suite with a Custom Extension<\/strong>\u201d.<\/p>\n When performing security assessments on HTTP-based applications, whether web, mobile, APIs, or thick clients, the standard workflow is straightforward: put Burp Suite in the middle, and you’re good to go. Most of the time, that’s all you need.<\/p>\n Every now and then, though, you run into a small but significant class of applications where that workflow breaks down. Custom protocols, payload encryption, request signatures, replay protection, non-standard encoding, these are the scenarios where you can no longer work manually the way you’re used to, and where Burp’s automated tools (Intruder, Scanner) stop being useful because they’re operating on data they can’t meaningfully read or modify.<\/p>\n In this talk I took one of these complexities as example, additional payload encryption, <\/strong>and used it as a vehicle to explore advanced approaches based on custom Burp extensions<\/strong> to restore full testability: working manually in Proxy and Repeater, running automated tools like Intruder and Scanner, and even driving external tools like SQLMap through Burp, all as if the complexity simply weren’t there.<\/p>\n The talk is quite dense, with probably more content than the available time \ud83d\ude06, but I’ve published the slides, the full code of the examples, and the recording, hoping they’ll help make these advanced topics as clear as possible.<\/p>\n You can find the slides<\/strong> and the example code<\/strong> in a dedicated GitHub repository<\/a> or in the #event-enthusiast<\/a> channel of PortSwigger Discord server.<\/p>\n And this is the video<\/strong> of the talk!<\/p>\n