skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

burp-suite

Automate Burp Suite Professional security testing via its MCP server.

11|1|Updated May 4, 2026
Search Tags:#mcp#web-security#penetration-testing#ssrf#burp-suite#idor#collaborator
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill burp-suite-dreadnode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: burp-suite
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/burp-suite
Command: npx skills add https://github.com/dreadnode/capabilities --skill burp-suite-dreadnode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill removes the manual overhead of operating Burp Suite for web application security testing, eliminating repetitive tasks like sending custom requests, sifting through proxy history, and manually triaging scanner findings.

Core Features & Use Cases

  • Proxy History Management: Query and filter HTTP and WebSocket proxy history with regex to quickly locate relevant traffic for security assessments.
  • Request Automation & Testing: Send custom HTTP/1.1 and HTTP/2 requests, push them to Repeater for manual iteration, or send to Intruder for automated fuzzing of parameters.
  • Vulnerability Validation: Retrieve Burp Scanner issues for triage, and use Collaborator out-of-band testing to confirm blind vulnerabilities like SSRF, blind XSS, and XXE.
  • Use Case: When testing a new API endpoint for insecure direct object reference (IDOR) flaws, use this Skill to pull recent proxy requests for the endpoint, send modified requests to Repeater to test access to other users' resources, and validate any blind findings with Collaborator payloads.

Quick Start

Use the burp-suite skill to retrieve the 10 most recent proxy HTTP requests for your target domain and send a modified version of the first request to Repeater for manual security testing.

Frequently Asked Questions about burp-suite

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Burp Suite web security testing without using the GUI?▼

You can automate web security testing by connecting directly to a running local Burp Suite Professional instance via its native MCP server, enabling programmatic HTTP request execution, proxy history analysis, and scanner issue retrieval without manual GUI operations.

Can I filter Burp Suite proxy history with regex during penetration testing?▼

Yes, you can query and filter both HTTP and WebSocket proxy history using regex patterns to quickly locate relevant traffic for security assessments, eliminating the need to manually sift through the Burp Suite GUI history tab.

How do I validate blind vulnerabilities like SSRF using Burp Collaborator?▼

You can validate blind vulnerabilities like SSRF, blind XSS, and XXE by leveraging Burp Collaborator for out-of-band testing, which confirms whether blind security flaws are triggered by monitoring external interactions without relying on visible application responses.

Do I need Burp Suite Professional running locally to use this automation Skill?▼

Yes, you need a running local instance of Burp Suite Professional. This Skill connects directly to the active Burp instance via its native MCP server to execute requests, manage Repeater and Intruder tabs, and validate out-of-band flaws.

What is the best way to test for IDOR flaws using Burp Suite automation?▼

To test for IDOR flaws, pull recent proxy requests for the target endpoint, send modified requests to Repeater to iterate on access to other users' resources, and use Collaborator payloads to validate any blind security findings triggered during the process.

Can I send custom HTTP/2 requests to Burp Intruder for automated fuzzing?▼

Yes, you can send custom HTTP/1.1 and HTTP/2 requests directly to Intruder for automated parameter fuzzing. This removes manual GUI overhead by pushing requests programmatically through the native MCP server to automate penetration testing workflows.

Related Skills

Explore More Software Engineering Skills→
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
dreadnodedreadnode
11

caido-proxy

Search and replay HTTP proxy traffic via Caido MCP tools.

Official
Intermediate
zebbernzebbern
4.5k

Burp Suite Web Application Testing

Automate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.

Community
Advanced