Send large numbers of HTTP requests and analyze the results

Integrates with the Retire.js repository to find vulnerable JavaScript libraries.

This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities.

Adds scan checks focused on Java environments and technologies.

Helps you launch HTTP Request Smuggling attacks, supports scanning for Request Smuggling vulnerabilities and also aids exploitation by handling cumbersome offset-tweaking for you

Provides request history view for all Burp tools.

Passively detects detailed server error messages.

Copies selected request(s) as Python-Requests invocations.

Converts JSON To XML, XML to JSON, body parameters to JSON, and body parameters to XML.

Customizable payload generator to detect and exploit command injection flaws during blind testing.

Augments your proxy traffic by injecting non-invasive headers designed to reveal backend systems by causing pingbacks to Burp Collaborator.

Adds various capabilities including SQL Mapper, User Generator and Prettier JS.

Adds headers useful for bypassing some WAF devices.

Extend the Burp active and passive scanner by creating custom scan checks with an intuitive graphical interface.

Finds unknown classes of injection vulnerabilities.

Automatically detects authorization enforcement.

Custom passive scan checks for asset discovery.

Provides some additional passive Scanner checks.

Extends Burp's active and passive scanning capabilities.