What you can do with Reburp

4 use cases

• Triage Burp proxy history with an AI agent

  Let an agent read recent proxy traffic over REST and rank the most unusual exchanges first.

  • Reburp
  • Security and science
  • Intermediate
  View prompt

  Using the reburp API at http://127.0.0.1:9090 (spec at /openapi.json), read the latest proxy history for <target host>, rank it by anomaly through /api/utils/rank, and return the top 10 exchanges with method, path, and status. Verify that each returned item matches an entry in /api/proxy/history before reporting it.

  Share Save

• Replay requests with and without tokens to find access gaps

  Send a request with and without its auth token and diff the responses to spot broken access control.

  • Reburp
  • Security and science
  • Advanced
  View prompt

  Using the reburp API at http://127.0.0.1:9090 with the spec at /openapi.json, send <request description> for <target host> once with its auth token and once without, then diff the two responses. Return whether the responses match and the status codes for each, and verify the result by checking the raw responses in Burp before calling it a finding.

  Share Save

• Scope a target and start a Burp scan over REST

  Add a host to Burp scope with one call, then start an audit or crawl through the scanner routes.

  • Reburp
  • Security and science
  • Intermediate
  View prompt

  Using the reburp API at http://127.0.0.1:9090 (spec at /openapi.json), add <target URL> to scope, start an audit through the scanner routes, and poll task status until it completes. Return the list of scanner issues with names and severities, and verify that the target is in scope with /api/scope before reporting results.

  Share Save

• Capture and drive the Burp window for a bug report

  Take screenshots of Burp and switch tabs or click elements over REST to document a finding.

  • Reburp
  • Security and science
  • Advanced
  View prompt

  Using the reburp API at http://127.0.0.1:9090 with the spec at /openapi.json, switch Burp to the <tab name> tab, click <element label>, and take a screenshot of the Burp window at each step. Return the screenshot files with a one-line description of each, and verify each screenshot shows the tab or element named before reporting it.

  Share Save

How to use Reburp

1. Check you have what it needs: Burp Suite with the Montoya API (reburp 1.1.14 lists 2026.7 as minimum; older Burp needs the matching older jar from Releases); The reburp-*.jar from the Releases page, or Java 17+ to build from source; Written authorization to test the target systems.
2. Open forefy/reburp on GitHub and read the README and license.
3. Download Reburp.jar from the Releases page, then in Burp open Extensions, Installed, Add, set Extension type to Java, select the jar, and click Next.
4. Run curl -s http://127.0.0.1:9090/api/status to confirm the extension is up.
5. Run curl -s "http://127.0.0.1:9090/api/proxy/history?limit=10" to read the latest proxy entries.
6. Open http://127.0.0.1:9090/docs in a browser to find the ranking route under /api/utils/rank in the spec, then point the agent at it.

These steps come from our top use case, Triage Burp proxy history with an AI agent, which also has a copy-paste agent prompt.

Reburp alternatives · Best AI repos for Security and science

About this repo

• Who it is forWeb security testers and AI agent builders who already have Burp Suite and want scripts or agents to read traffic, send requests, and run Burp features over HTTP.
• Why it is hot
• LanguageKotlin
• Sourcegithub.com/forefy/reburp · Back to Hot repos

Requirements

• Burp Suite with the Montoya API (reburp 1.1.14 lists 2026.7 as minimum; older Burp needs the matching older jar from Releases)
• The reburp-*.jar from the Releases page, or Java 17+ to build from source
• Written authorization to test the target systems
• A terminal with curl, or an AI agent that can make HTTP calls to 127.0.0.1:9090

Related repos

• Trended earlier Cosy Redact Gateway A lightweight, stateless privacy gateway that sits between your app and LLM APIs, redacting detected secrets and sensitive values before they reach OpenAI or Anthropic upstreams and restoring placeholders in responses.
• Trended earlier Security Audit Skill A coding-agent skill that runs multi-phase security audits on a codebase and writes machine-readable, independently verified findings.
• Trended earlier Jev Guard jev-guard is a security hook for coding agents that scores each tool call with session context and returns deny, ask, or allow, flags prompt injection in tool results, and checks skills and plugins, powered by Jev.