Welcome to the next generation of web application penetration testing – using WebKit to own the web. BurpKit is a BurpSuite plugin which helps in assessing complex web apps that render the contents of their pages dynamically. It also provides a bi-directional JavaScript bridge API which allows users to create quick one-off BurpSuite plugin prototypes which can interact directly with the DOM and Burp’s extender API.
System Requirements
BurpKit has the following system requirements:
- Oracle JDK >=8u50 and <9 (Download)
- At least 4GB of RA
Installation
Installing BurpKit is simple:
- Download the latest prebuilt release from the GitHub releases page.
- Open BurpSuite and navigate to the Extender tab.
- Under Burp Extensions click the Add button.
- In the Load Burp Extension dialog, make sure that Extension Type is set to Java and click the Select file … button under Extension Details.
- Select the BurpKit-<version>.jar file and click Next when done.
If all goes well, you will see three additional top-level tabs appear in BurpSuite:
- BurpKitty: a courtesy browser for navigating the web within BurpSuite.
- BurpScript IDE: a lightweight integrated development environment for writing JavaScript-based BurpSuite plugins and other things.
- Jython: an integrated python interpreter console and lightweight script text editor.
BurpScript
BurpScript enables users to write desktop-based JavaScript applications as well as BurpSuite extensions using the JavaScript scripting language. This is achieved by injecting two new objects by default into the DOM on page load:
- burpKit: provides numerous features including file system I/O support and easy JS library injection.
- burpCallbacks: the JavaScript equivalent of the IBurpExtenderCallbacks interface in Java with a few slight modifications.
