burpai

Name: burpai
Author: srinivasans13

srinivasans13 February 15, 2026

2 copies 0 downloads

Autonomous AI penetration testing agent for Burp Suite. Agentic pentesting with local/cloud LLMs (Ollama, Gemini, DeepSeek, OpenRouter) via Montoya API.

Agent Definition

# burpai — Autonomous AI Pentest Agent for Burp Suite

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

A **Burp Suite extension** built on the [Montoya API](https://portswigger.github.io/burp-extensions-montoya-api/javadoc/) that embeds an autonomous AI penetration testing agent directly into Burp. All HTTP traffic flows through Burp's engine — every request the agent fires is visible in the HTTP history, and you can inspect it in Burp's native editors in real time.

---

## Features at a Glance

| Feature | Description |
|---|---|
| **AI Pentester** | Autonomous agentic loop — probes targets, fires requests through Burp, confirms and reports vulnerabilities |
| **11 agent tools** | HTTP requests, crawling, fuzzing, extraction, decoding, variable interpolation, site-map querying, reporting, run control |
| **Multi-provider LLM** | Ollama (local), Google DeepSeek, **Anthropic Claude**, **DeepSeek**, **OpenAI**, and **OpenRouter** |
| **Focused task mode** | "Find SSRF" tests *only* SSRF — 19 vulnerability classes auto-detected from your prompt |
| **Timing-based detection** | `fuzz_parameter` tracks response latency per payload — catches blind SSRF and blind CMDi |
| **Integrated Token Map** | Intelligent detection of JWT, UUID, API keys, and CSRF tokens across headers and cookies with automatic mirror detection |
| **CSV Export** | Export agent findings and HTTP history directly to CSV for external reporting |
| **HTML reports** | Structured findings report saved to `~/burpai_logs/` |
| **Burp native reporting** | Confirmed findings posted directly to the Burp Dashboard Issues pane — severity, confidence, PoC and evidence requests included |
| **AI Personas** | Task-focused personas (Auth, SSRF, Injection, etc.) sharpen the agent's strategy from iteration one |
| **Vector memory** | Per-target memory persists WAF info, endpoints, parameters and vuln history across runs |
| **Repeater DeepSeek** | AI suggestion panel embedded in every Re

Comments

More Agents

View all

hybrid-model-workflow

HAL 分层混合模型工作流 — 强模型(Claude)负责理解/拆解/验收，低成本模型(DeepSeek)负责检索/提取/清洗。Hermes Agent skill。

ph4ble

Dynamic-Review-Agent

An LLM agent fine-tuned on DeepSeek for spaced repetition, dynamically integrating knowledge points based on the Ebbinghaus forgetting curve.

1838177

StellarOS-Watch

基于 STM32F103 构建的端到端 AI 智能手表生态。自研“零重定位”原生机器码动态加载引擎与页面栈式 UI 框架；集成生产级 OTA 回滚保护机制与高带宽（921600 baud）串口协议栈。通过 Node.js 中继实现 DeepSeek AI 语义控制及 ASRPRO 语音全双工交互，是一个集成了分布式计算、现代存储管理与 AI Agent 的嵌入式全栈工程。

chenshuang888