burpgpt

Why we included this project

For security testers who already work inside Burp Suite, this extension is a straightforward add: it hooks a configurable OpenAI model into the passive scanner, so every request captured during a test gets an AI-driven pass. Because you can write your own prompts, the analysis can be shaped around a specific application's logic rather than just signature matches, which is where it earns its keep for spotting unusual, bespoke flaws that off-the-shelf scanners tend to miss. It also summarizes the findings into an automated report that gives a pentester a quick higher-level read on where to dig deeper. The caveats matter though: the Community edition is no longer maintained, and all request traffic goes to OpenAI, so it's not an option for engagements where data has to stay in-house. For teams that can live with that, it's a practical way to add a generative second opinion to routine passive scanning.