burpsuite-project-parser by trailofbits/skills
npx skills add https://github.com/trailofbits/skills --skill burpsuite-project-parser使用 burpsuite-project-file-parser 扩展从 Burp Suite 项目文件中搜索和提取数据。
此技能将解析工作委托给 Burp Suite Professional——它不直接解析 .burp 文件。
必需条件:
安装扩展:
使用包装脚本:
{baseDir}/scripts/burp-search.sh /path/to/project.burp [FLAGS]
该脚本使用环境变量以确保跨平台兼容性:
BURP_JAVA:Java 可执行文件路径广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
BURP_JAR:burpsuite_pro.jar 路径有关设置说明,请参阅平台配置。
务必使用子组件过滤器,而不是完整导出。 完整的 proxyHistory 或 siteMap 可能返回千兆字节的数据。子组件过滤器仅返回您需要的内容。
| 过滤器 | 返回内容 | 典型大小 |
|---|---|---|
proxyHistory.request.headers | 仅请求行和请求头 | 小 (< 1KB/记录) |
proxyHistory.request.body | 仅请求体 | 可变 |
proxyHistory.response.headers | 仅状态码和响应头 | 小 (< 1KB/记录) |
proxyHistory.response.body | 仅响应体 | 巨大 - 避免 |
siteMap.request.headers | 站点地图的相同内容 | 小 |
siteMap.request.body | 可变 | |
siteMap.response.headers | 小 | |
siteMap.response.body | 巨大 - 避免 |
从请求头/响应头开始,而不是请求体/响应体:
# 良好 - 仅请求头/响应头,安全检索
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | head -c 50000
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | head -c 50000
# 错误 - 完整记录包含请求体/响应体,可能达到千兆字节
{baseDir}/scripts/burp-search.sh project.burp proxyHistory # 切勿这样做
在查看请求头/响应头后,仅获取特定 URL 的请求体/响应体,并且务必截断:
# 1. 首先,从请求头/响应头中找到感兴趣的 URL
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | \
jq -r 'select(.headers | test("text/html")) | .url' | head -n 20
# 2. 然后使用目标正则表达式搜索请求体/响应体 - 必须将请求体/响应体截断至 1000 个字符
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*specific-pattern.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
硬性规定:正文内容 > 1000 个字符绝不能进入上下文。 如果用户需要完整的正文内容,他们必须在 Burp Suite 的 UI 中查看。
responseHeader='.*regex.*'
搜索所有响应头。输出:{"url":"...", "header":"..."}
示例 - 查找服务器签名:
responseHeader='.*(nginx|Apache|Servlet).*' | head -c 50000
responseBody='.*regex.*'
强制要求:始终将正文内容截断至最多 1000 个字符。 每个响应体可能达到数兆字节。
# 必需格式 - 始终截断 .body 字段
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*<form.*action.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
切勿检索完整的正文内容。 如果您需要查看更多特定响应的内容,请要求用户在 Burp Suite 的 UI 中打开它。
auditItems
返回所有安全发现。输出包括:name、severity、confidence、host、port、protocol、url。
注意: 审计项很小(不包含请求体/响应体)- 使用 head -n 100 检索是安全的。
proxyHistory
切勿直接使用此命令。 请改用子组件过滤器:
proxyHistory.request.headersproxyHistory.response.headerssiteMap
切勿直接使用此命令。 请改用子组件过滤器。
关键:在检索数据之前,务必检查结果大小。 广泛的搜索可能返回数千条记录,每条记录可能达到数兆字节。这将超出上下文窗口。
在任何搜索之前,检查记录数和字节大小:
# 检查记录数和总字节数 - 切勿跳过此步骤
{baseDir}/scripts/burp-search.sh project.burp proxyHistory | wc -cl
{baseDir}/scripts/burp-search.sh project.burp "responseHeader='.*Server.*'" | wc -cl
{baseDir}/scripts/burp-search.sh project.burp auditItems | wc -cl
wc -cl 输出显示:<字节数> <行数>(例如,524288 42 表示 42 条记录共 512KB)。
解释结果 - 两者都必须通过:
| 指标 | 安全 | 范围较窄的搜索 | 范围太广 | 停止 |
|---|---|---|---|---|
| 行数 | < 50 | 50-200 | 200+ | 1000+ |
| 字节数 | < 50KB | 50-200KB | 200KB+ | 1MB+ |
单行 10MB 的响应将显示高字节数但只有 1 行 - 字节检查会捕获这种情况。
如果数量/大小过高:
使用子组件过滤器(见上表):
# 替代:proxyHistory (千兆字节)
# 使用:proxyHistory.request.headers (千字节)
缩小正则表达式模式:
# 范围太广(匹配所有内容):
responseHeader='.*'
# 更好 - 针对特定请求头/响应头:
responseHeader='.*X-Frame-Options.*'
responseHeader='.*Content-Security-Policy.*'
在检索前使用 jq 过滤:
# 仅获取特定内容类型
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | \
jq -c 'select(.url | test("/api/"))' | head -n 50
即使在缩小范围后,也始终通过管道进行截断:
# 始终使用 head -c 限制总字节数(最大 50KB)
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | head -c 50000
# 对于请求体/响应体搜索,截断每个 JSON 对象的 body 字段:
{baseDir}/scripts/burp-search.sh project.burp "responseBody='pattern'" | \
head -n 20 | jq -c '.body = (.body | if length > 1000 then .[:1000] + "...[TRUNCATED]" else . end)'
# 同时限制记录数和字节大小:
{baseDir}/scripts/burp-search.sh project.burp auditItems | head -n 50 | head -c 50000
要执行的硬性限制:
对所有输出使用 head -c 50000(最大 50KB)
将 .body 字段截断至 1000 个字符 - 强制要求,无例外
jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
切勿在未先计数和截断的情况下运行以下命令:
proxyHistory / siteMap(完整导出 - 始终使用子组件过滤器)responseBody='...' 搜索(每个请求体/响应体可能达到数兆字节).* 或 .+确定范围 - 您要查找什么?(特定漏洞类型、端点、请求头/响应头模式)
首先搜索审计项 - 从 Burp 的发现开始:
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq 'select(.severity == "High")'
检查置信度分数 - 筛选出可操作的发现:
... | jq 'select(.confidence == "Certain" or .confidence == "Firm")'
提取受影响的 URL - 获取攻击面:
... | jq -r '.url' | sort -u
搜索原始流量以获取上下文 - 检查实际的请求/响应:
{baseDir}/scripts/burp-search.sh project.burp "responseBody='pattern'"
手动验证 - Burp 的发现是指标,不是证据。验证每一个发现。
Burp 同时报告严重性(High/Medium/Low)和置信度(Certain/Firm/Tentative)。在处理时两者都要使用:
| 组合 | 含义 |
|---|---|
| High + Certain | 很可能是真实漏洞,优先调查 |
| High + Tentative | 通常是误报,报告前需验证 |
| Medium + Firm | 值得调查,可能需要手动验证 |
一个“严重性高,置信度低”的发现通常是误报。不要仅根据严重性报告发现。
代理历史记录仅包含 Burp 捕获的内容。由于以下原因,它可能缺少流量:
如果未找到预期的流量,请在原始项目中检查 Burp 的范围和代理设置。
响应体可能经过 gzip 压缩、分块或使用非 UTF8 编码。适用于纯文本的正则表达式模式可能对编码的响应静默失败。如果搜索返回的结果少于预期:
导致遗漏漏洞或错误报告的常见捷径:
| 捷径 | 错误原因 |
|---|---|
| “这个正则表达式看起来不错” | 先在样本数据上验证——编码和转义会导致静默失败 |
| “严重性高 = 必须修复” | 也要检查置信度分数;Burp 有误报 |
| “所有审计项都相关” | 根据实际威胁模型进行筛选;并非每个发现对每个应用都重要 |
| “代理历史记录是完整的” | 可能被 Burp 范围/拦截设置过滤;您只看到 Burp 捕获的内容 |
| “Burp 发现了它,所以它是漏洞” | Burp 的发现需要手动验证——它们表明潜在问题,而非证据 |
所有输出均为 JSON 格式,每行一个对象。通过管道传递给 jq 进行格式化:
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq .
使用 grep 过滤:
{baseDir}/scripts/burp-search.sh project.burp auditItems | grep -i "sql injection"
搜索 CORS 请求头/响应头(带字节限制):
{baseDir}/scripts/burp-search.sh project.burp "responseHeader='.*Access-Control.*'" | head -c 50000
获取所有严重性高的发现(审计项很小,但仍需限制):
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq -c 'select(.severity == "High")' | head -n 100
仅从代理历史记录中提取请求 URL:
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | jq -r '.request.url' | head -n 200
搜索响应体(必须将正文截断至 1000 个字符):
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*password.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
包装脚本需要两个环境变量来定位 Burp Suite 捆绑的 Java 和 JAR 文件。
export BURP_JAVA="/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java"
export BURP_JAR="/Applications/Burp Suite Professional.app/Contents/Resources/app/burpsuite_pro.jar"
$env:BURP_JAVA = "C:\Program Files\BurpSuiteProfessional\jre\bin\java.exe"
$env:BURP_JAR = "C:\Program Files\BurpSuiteProfessional\burpsuite_pro.jar"
export BURP_JAVA="/opt/BurpSuiteProfessional/jre/bin/java"
export BURP_JAR="/opt/BurpSuiteProfessional/burpsuite_pro.jar"
将这些导出添加到您的 shell 配置文件(.bashrc、.zshrc 等)中以持久化。
如果不使用包装脚本,直接调用:
"$BURP_JAVA" -jar -Djava.awt.headless=true "$BURP_JAR" \
--project-file=/path/to/project.burp [FLAGS]
每周安装数
793
代码仓库
GitHub 星标数
3.9K
首次出现
Jan 19, 2026
安全审计
安装于
claude-code707
opencode682
gemini-cli677
cursor671
codex667
github-copilot648
Search and extract data from Burp Suite project files using the burpsuite-project-file-parser extension.
This skill delegates parsing to Burp Suite Professional - it does not parse .burp files directly.
Required:
Install the extension:
Use the wrapper script:
{baseDir}/scripts/burp-search.sh /path/to/project.burp [FLAGS]
The script uses environment variables for platform compatibility:
BURP_JAVA: Path to Java executableBURP_JAR: Path to burpsuite_pro.jarSee Platform Configuration for setup instructions.
ALWAYS use sub-component filters instead of full dumps. Full proxyHistory or siteMap can return gigabytes of data. Sub-component filters return only what you need.
| Filter | Returns | Typical Size |
|---|---|---|
proxyHistory.request.headers | Request line + headers only | Small (< 1KB/record) |
proxyHistory.request.body | Request body only | Variable |
proxyHistory.response.headers | Status + headers only | Small (< 1KB/record) |
proxyHistory.response.body | Response body only | LARGE - avoid |
siteMap.request.headers |
Start with headers, not bodies:
# GOOD - headers only, safe to retrieve
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | head -c 50000
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | head -c 50000
# BAD - full records include bodies, can be gigabytes
{baseDir}/scripts/burp-search.sh project.burp proxyHistory # NEVER DO THIS
Only fetch bodies for specific URLs after reviewing headers, and ALWAYS truncate:
# 1. First, find interesting URLs from headers
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | \
jq -r 'select(.headers | test("text/html")) | .url' | head -n 20
# 2. Then search bodies with targeted regex - MUST truncate body to 1000 chars
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*specific-pattern.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
HARD RULE: Body content > 1000 chars must NEVER enter context. If the user needs full body content, they must view it in Burp Suite's UI.
responseHeader='.*regex.*'
Searches all response headers. Output: {"url":"...", "header":"..."}
Example - find server signatures:
responseHeader='.*(nginx|Apache|Servlet).*' | head -c 50000
responseBody='.*regex.*'
MANDATORY: Always truncate body content to 1000 chars max. Response bodies can be megabytes each.
# REQUIRED format - always truncate .body field
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*<form.*action.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
Never retrieve full body content. If you need to see more of a specific response, ask the user to open it in Burp Suite's UI.
auditItems
Returns all security findings. Output includes: name, severity, confidence, host, port, protocol, url.
Note: Audit items are small (no bodies) - safe to retrieve with head -n 100.
proxyHistory
NEVER use this directly. Use sub-component filters instead:
proxyHistory.request.headersproxyHistory.response.headerssiteMap
NEVER use this directly. Use sub-component filters instead.
CRITICAL: Always check result size BEFORE retrieving data. A broad search can return thousands of records, each potentially megabytes. This will overflow the context window.
Before any search, check BOTH record count AND byte size:
# Check record count AND total bytes - never skip this step
{baseDir}/scripts/burp-search.sh project.burp proxyHistory | wc -cl
{baseDir}/scripts/burp-search.sh project.burp "responseHeader='.*Server.*'" | wc -cl
{baseDir}/scripts/burp-search.sh project.burp auditItems | wc -cl
The wc -cl output shows: <bytes> <lines> (e.g., 524288 42 means 512KB across 42 records).
Interpret the results - BOTH must pass:
| Metric | Safe | Narrow search | Too broad | STOP |
|---|---|---|---|---|
| Lines | < 50 | 50-200 | 200+ | 1000+ |
| Bytes | < 50KB | 50-200KB | 200KB+ | 1MB+ |
A single 10MB response on one line will show high byte count but only 1 line - the byte check catches this.
If count/size is too high:
Use sub-component filters (see table above):
# Instead of: proxyHistory (gigabytes)
# Use: proxyHistory.request.headers (kilobytes)
Narrow regex patterns:
# Too broad (matches everything):
responseHeader='.*'
# Better - target specific headers:
responseHeader='.*X-Frame-Options.*'
responseHeader='.*Content-Security-Policy.*'
Filter with jq before retrieving:
# Get only specific content types
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.response.headers | \
jq -c 'select(.url | test("/api/"))' | head -n 50
Even after narrowing, always pipe through truncation:
# ALWAYS use head -c to limit total bytes (max 50KB)
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | head -c 50000
# For body searches, truncate each JSON object's body field:
{baseDir}/scripts/burp-search.sh project.burp "responseBody='pattern'" | \
head -n 20 | jq -c '.body = (.body | if length > 1000 then .[:1000] + "...[TRUNCATED]" else . end)'
# Limit both record count AND byte size:
{baseDir}/scripts/burp-search.sh project.burp auditItems | head -n 50 | head -c 50000
Hard limits to enforce:
head -c 50000 (50KB max) on ALL output
Truncate.body fields to 1000 chars - MANDATORY, no exceptions
jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
Never run these without counting first AND truncating:
proxyHistory / siteMap (full dumps - always use sub-component filters)responseBody='...' searches (bodies can be megabytes each).* or .+Identify scope - What are you looking for? (specific vuln type, endpoint, header pattern)
Search audit items first - Start with Burp's findings:
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq 'select(.severity == "High")'
Check confidence scores - Filter for actionable findings:
... | jq 'select(.confidence == "Certain" or .confidence == "Firm")'
Extract affected URLs - Get the attack surface:
... | jq -r '.url' | sort -u
Search raw traffic for context - Examine actual requests/responses:
{baseDir}/scripts/burp-search.sh project.burp "responseBody='pattern'"
Validate manually - Burp findings are indicators, not proof. Verify each one.
Burp reports both severity (High/Medium/Low) and confidence (Certain/Firm/Tentative). Use both when triaging:
| Combination | Meaning |
|---|---|
| High + Certain | Likely real vulnerability, prioritize investigation |
| High + Tentative | Often a false positive, verify before reporting |
| Medium + Firm | Worth investigating, may need manual validation |
A "High severity, Tentative confidence" finding is frequently a false positive. Don't report findings based on severity alone.
Proxy history only contains what Burp captured. It may be missing traffic due to:
If you don't find expected traffic, check Burp's scope and proxy settings in the original project.
Response bodies may be gzip compressed, chunked, or use non-UTF8 encoding. Regex patterns that work on plaintext may silently fail on encoded responses. If searches return fewer results than expected:
Common shortcuts that lead to missed vulnerabilities or false reports:
| Shortcut | Why It's Wrong |
|---|---|
| "This regex looks good" | Verify on sample data first—encoding and escaping cause silent failures |
| "High severity = must fix" | Check confidence score too; Burp has false positives |
| "All audit items are relevant" | Filter by actual threat model; not every finding matters for every app |
| "Proxy history is complete" | May be filtered by Burp scope/intercept settings; you see only what Burp captured |
| "Burp found it, so it's a vuln" | Burp findings require manual verification—they indicate potential issues, not proof |
All output is JSON, one object per line. Pipe to jq for formatting:
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq .
Filter with grep:
{baseDir}/scripts/burp-search.sh project.burp auditItems | grep -i "sql injection"
Search for CORS headers (with byte limit):
{baseDir}/scripts/burp-search.sh project.burp "responseHeader='.*Access-Control.*'" | head -c 50000
Get all high-severity findings (audit items are small, but still limit):
{baseDir}/scripts/burp-search.sh project.burp auditItems | jq -c 'select(.severity == "High")' | head -n 100
Extract just request URLs from proxy history:
{baseDir}/scripts/burp-search.sh project.burp proxyHistory.request.headers | jq -r '.request.url' | head -n 200
Search response bodies (MUST truncate body to 1000 chars):
{baseDir}/scripts/burp-search.sh project.burp "responseBody='.*password.*'" | \
head -n 10 | jq -c '.body = (.body[:1000] + "...[TRUNCATED]")'
The wrapper script requires two environment variables to locate Burp Suite's bundled Java and JAR file.
export BURP_JAVA="/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java"
export BURP_JAR="/Applications/Burp Suite Professional.app/Contents/Resources/app/burpsuite_pro.jar"
$env:BURP_JAVA = "C:\Program Files\BurpSuiteProfessional\jre\bin\java.exe"
$env:BURP_JAR = "C:\Program Files\BurpSuiteProfessional\burpsuite_pro.jar"
export BURP_JAVA="/opt/BurpSuiteProfessional/jre/bin/java"
export BURP_JAR="/opt/BurpSuiteProfessional/burpsuite_pro.jar"
Add these exports to your shell profile (.bashrc, .zshrc, etc.) for persistence.
If not using the wrapper script, invoke directly:
"$BURP_JAVA" -jar -Djava.awt.headless=true "$BURP_JAR" \
--project-file=/path/to/project.burp [FLAGS]
Weekly Installs
793
Repository
GitHub Stars
3.9K
First Seen
Jan 19, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykWarn
Installed on
claude-code707
opencode682
gemini-cli677
cursor671
codex667
github-copilot648
Vue 3 调试指南:解决响应式、计算属性与监听器常见错误
9,800 周安装
Devcontainer 设置技能:一键创建预配置开发容器,集成 Claude Code 和语言工具
739 周安装
Plankton代码质量工具:Claude Code自动格式化与Linter强制执行系统
741 周安装
ML Pipeline专家指南:生产级机器学习流水线架构、编排与自动化部署
741 周安装
Tavily API 网络搜索技能 - AI 优化搜索,获取结构化实时网络数据
742 周安装
Playwright 开发指南:微软官方自动化测试框架架构、API 与打包教程
745 周安装
PWA开发指南:构建渐进式Web应用,实现离线工作与原生应用体验
746 周安装
| Same as above for site map |
| Small |
siteMap.request.body | Variable |
siteMap.response.headers | Small |
siteMap.response.body | LARGE - avoid |