菜单
Queries Burp proxy history, sends requests via Repeater, configures Intruder attacks, retrieves scanner findings, and performs OOB testing with Collaborator. Use when working with Burp proxy history, sending requests through Burp, using Repeater/Intruder, checking scanner issues, or performing OOB testing with Collaborator.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | burp-suite |
| description | Queries Burp proxy history, sends requests via Repeater, configures Intruder attacks, retrieves scanner findings, and performs OOB testing with Collaborator. Use when working with Burp proxy history, sending requests through Burp, using Repeater/Intruder, checking scanner issues, or performing OOB testing with Collaborator. |
Burp Suite Professional exposes 24 tools via its native MCP server. These connect directly to the running Burp instance — no wrapper or SDK needed.
send_http1_request(content, targetHostname, targetPort, usesHttps)
send_http2_request(headers, pseudoHeaders, requestBody, targetHostname, targetPort, usesHttps)
content is the full raw HTTP/1.1 request including request line and headers. Use \r\n line endings.
send_http1_request(
content="GET /api/users HTTP/1.1\r\nHost: target.com\r\nCookie: session=abc\r\n\r\n",
targetHostname="target.com",
targetPort=443,
usesHttps=true
)
All requests appear in Burp's proxy history automatically. Verify: After sending, confirm the request appears with get_proxy_http_history(count=1, offset=0).
get_proxy_http_history(count, offset)
get_proxy_http_history_regex(count, offset, regex)
get_proxy_websocket_history(count, offset)
get_proxy_websocket_history_regex(count, offset, regex)
offset=0, count=10 gets the 10 most recent items. Use regex to filter by URL, header, or body content.
create_repeater_tab(content, targetHostname, targetPort, usesHttps, tabName?)
send_to_intruder(content, targetHostname, targetPort, usesHttps, tabName?)
Send a request to Repeater for manual iteration or to Intruder for automated fuzzing. Always name tabs descriptively (e.g. "IDOR /api/users").
get_scanner_issues(count, offset)
Returns vulnerabilities found by Burp's active and passive scanner with severity, confidence, and affected URLs.
generate_collaborator_payload(customData?)
get_collaborator_interactions(payloadId?)
Workflow:
generate_collaborator_payload → get a unique *.burpcollaborator.net URL + payloadIdget_collaborator_interactions(payloadId) → check for DNS/HTTP/SMTP callbacksThis is the primary tool for confirming blind vulnerabilities where no in-band response is visible.
set_proxy_intercept_state(intercepting: bool)
set_task_execution_engine_state(running: bool)
get_active_editor_contents()
set_active_editor_contents(text)
Read or set the content of the user's active Burp message editor tab.
url_encode(content) url_decode(content)
base64_encode(content) base64_decode(content)
generate_random_string(length, characterSet)
output_project_options() set_project_options(json)
output_user_options() set_user_options(json)
Export config first to understand the schema before setting options.
generate_collaborator_payload → inject URL into SSRF parameter via send_http1_request → get_collaborator_interactions to confirm callbackcreate_repeater_tab with request for resource A → modify ID to resource B → compare responsesget_scanner_issues(count=20, offset=0) → review severity/confidence → replay high-confidence findings with send_http1_request to confirmPre-engagement reconnaissance workflow using HackerOne MCP tools to enumerate program scope, study prior disclosures, and identify high-value targets. Use when starting a new HackerOne program engagement, building an asset inventory, or planning target selection before active testing.
Pre-submission eligibility check for bug bounty findings. Catches ineligible patterns, AI/scanner false positives, and generates impact justification for borderline lows. Use before writing a report or when assessing whether a finding is worth reporting.
Static code analysis for DOM-based vulnerabilities in client-side JavaScript -- source/sink enumeration via grep and AST tools, data flow tracing, sanitization assessment, and framework-specific sink detection. Use when performing pre-commit reviews, auditing large codebases without dynamic execution, or triaging minified code for XSS issues.
Create custom jxscout analyzers (regex, derived, or script-based) and retrigger analysis. Use when the user wants to find specific code patterns across all project files, add new match kinds, or extend jxscout's static analysis capabilities.
Use when the user wants to connect to Jira, Confluence, or Compass — search issues with JQL, read or create issues and pages, link content across products, or set up Atlassian auth. The connector — not security tradecraft.
Use when the user wants to connect to Azure DevOps — query Boards work items with WIQL, read PRs, inspect pipeline runs, create or update work items and wiki pages, or set up ADO auth. The connector — not security tradecraft.