Introduction
When you don’t have Internet connection during a web application pentest and you still want to install some BApps in the Burp Suite, you have to download them manually from the BApp Store. If you use a lot extensions, this can be a tedious task. It’s possible to download all BApps using a little script to simplify this task.
Script
The following script can be used to download all Burp Suite BApps from the BApp Store:
#!/usr/bin/env bash
mkdir bapps
curl -s https://portswigger.net/bappstore | awk -F '["<>/]' '/bapp-label heading-4/{ print $7,$9 }' | while read id name
do
echo "Downloading $name..."
curl -s -L "https://portswigger-cdn.net/bappstore/bapps/download/$id" -o "bapps/${name//[^a-z0-9A-Z]/_}.bapp"
done
This script can also be found in my Scripts repository on GitHub: download-burpsuite-bapps.
When executed, the output looks like this:
$ download-burpsuite-bapps
Downloading .NET Beautifier...
Downloading 403 Bypasser...
Downloading 5GC API Parser...
Downloading Active Scan++...
Downloading Add & Track Custom Issues...
Downloading Add Custom Header...
Downloading Add to SiteMap+...
[...]
Depending on the Internet connection, it takes some minutes do download all extensions.
The script creates a new directory bapps containing all extensions:
$ ls bapps/
403_Bypasser.bapp
5GC_API_Parser.bapp
Active_Scan__x2B___x2B_.bapp
Add__amp__Track_Custom_Issues.bapp
Add_Custom_Header.bapp
Additional_CSRF_Checks.bapp
Additional_Scanner_Checks.bapp
Add_to_SiteMap__x2B_.bapp
Add_to_TLS_Pass_Through.bapp
Adhoc_Payload_Processors.bapp
AES_Killer__decrypt_AES_traffic_on_the_fly.bapp
AES_Payloads.bapp
Agartha___LFI__RCE__SQLi__Auth__HTTP_to_JS.bapp
Anonymous_Cloud__Configuration_and_Subdomain_Takeover_Scanner.bapp
Anti_CSRF_Token_From_Referer.bapp
[...]
These bapp files can then be installed in Burp manually (Extensions → BAp Store → Manual install).
References
- BApp Store: https://portswigger.net/bappstore
- Burp Suite Documentation “Installing extensions”: https://portswigger.net/burp/documentation/desktop/extensions/installing-extensions
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.