Burpmcp

🚀 FanTong MCP

FanTong MCP is an enhanced Burp Suite extension that leverages modern AI technology to assist application security testers, vulnerability researchers, and bounty hunters.

FanTong MCP is an enhanced Burp Suite extension tool that utilizes modern artificial intelligence technology to assist application security testers, vulnerability researchers, and bounty hunters. Every day, large language models are continuously improving in terms of context window size, response speed, and knowledge and reasoning abilities. FanTong MCP allows you to leverage this inevitable technological advantage when testing HTTP-based applications, providing you with a super-intelligent assistant to help you explore unknown attack surfaces and track complex vulnerabilities.

Although other MCP servers for Burp Suite exist, they only provide general access to Burp Suite tools and data, such as running scans, viewing issues, and reading proxy history. FanTong MCP focuses on enhancing the manual testing process through LLM (Large Language Model). It features a simple user interface that allows you to pass specific requests as context to the AI and monitor MCP messages and AI-generated requests. Additionally, the tool has been reliability-tested for HTTP 1.1 and 2 and supports offline testing by accessing the Burp Collaborator.

🚀 Quick Start

✨ Features

• Leverage modern AI technology to assist in application security testing.
• Provide a super-intelligent assistant for exploring attack surfaces and tracking vulnerabilities.
• Focus on enhancing the manual testing process through LLM.
• Feature a simple user interface for passing requests to AI and monitoring messages.
• Support offline testing via Burp Collaborator.

📦 Installation

Download the JAR file from the release page and load it into Burp to complete the installation.

The MCP server runs on port 8181 of localhost by default, using the SSE (Server-Sent Events) protocol. The configuration syntax varies depending on your MCP client. Here is an example using the Dive MCP client:

{
  "mcpServers": {
    "BurpMCP": {
      "transport": "sse",
      "url": "http://localhost:8181/mcp/sse"
    }
  }
}

To use FanTong MCP with Claude Desktop, download the stdio-bridge.py script and install the required dependencies:

pip3 install typer mcp

Then, add the following configuration to your claude_desktop_config.json file. Ensure that the host and port match your configuration in BurpMCP.

{
  "mcpServers": {
    "BurpMCP": {
      "command": "python3",
      "args": ["path/to/stdio-bridge.py", "http://localhost:8181/mcp/sse"],
      "env": {}
    }
  }
}

💻 Usage Examples

Basic Usage

To send a request to BurpMCP, right-click on any request and select Extensions -> Send to BurpMCP.

The request will be displayed in the "Saved Requests" tab. Each saved request includes a comment column for providing additional context information to the LLM. LLMs can also update the comments in each saved request to record important details or save requests for future analysis.

Using your preferred MCP client, you can prompt the LLM to retrieve saved requests and send subsequent requests to assist with testing.

Claude attempts to solve problems in the lab:

📚 Documentation

Check out the successful cases in the Showcase for examples of chat logs demonstrating the successful use of BurpMCP.

Thanks to the following individuals for providing the examples:

• hunterverhelst

🔧 Known Issues

• LLMs sometimes forget to add important components to requests, such as the Content-Length header or URL encoding. This is not an issue with the extension but a limitation of the LLM. If necessary, inform the LLM of this and guide it on how to solve the problem.
• The tool parameters specify prohibited headers that should not be included in HTTP/2 requests, but sometimes LLMs may ignore this requirement. If an HTTP/2 request fails, check for any invalid headers in the request.
• Sometimes LLMs may return Chinese content, which may not meet your expectations. Adjust the prompts or configuration as needed.

🔧 Compilation

To build from source, follow these steps:

git clone https://github.com/yourusername/burpmcp.git
cd burpmcp
mvn clean package

🤝 Contribution

For issues, feature requests, or any questions, please open an issue. If you want to contribute code, please submit a PR. If you discover vulnerabilities or other interesting things using this tool, please send screenshots or chat logs. I'd be happy to include them in the Showcase. Thank you for trying FanTong MCP, and happy testing!