burpsuite-project-parser

Search and extract HTTP traffic and audit findings from Burp Suite project files.

Updated Mar 22, 2026
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill burpsuite-project-parser-tech-hy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: burpsuite-project-parser
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/burpsuite-project-parser
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill burpsuite-project-parser-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Burp Suite project files (.burp) can contain gigabytes of captured HTTP traffic that is impractical to browse manually. This Skill lets you search response headers and bodies with regex, extract security audit findings, and dump proxy history or site map data directly from the command line. ## Core Features & Use Cases - Regex Search of HTTP Traffic: Search response headers and bodies across an entire Burp project using patterns like responseHeader='.*nginx.*'. - Audit Finding Extraction: Pull all Burp Scanner findings with severity, confidence, host, and URL fields for triage. - Sub-Component Filtering: Retrieve only request/response headers instead of full proxy history dumps to avoid context overflow. - Use Case: During a penetration test report review, extract all high-severity findings with auditItems, then search response bodies for leaked patterns like passwords or tokens to validate the findings. ## Quick Start Ask the AI to search a Burp project file for high-severity audit findings or to grep response headers for a specific pattern, providing the path to your .burp file.

Frequently Asked Questions about burpsuite-project-parser

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search a Burp Suite project file from the command line?

Run the burp-search.sh wrapper script with the project file path and a search flag, such as `burp-search.sh project.burp "responseHeader='.*nginx.*'"`. Output is JSON, one object per line, which you can pipe to jq for filtering.

How do I extract security audit findings from a .burp file?

Use the auditItems flag to return all Burp Scanner findings including name, severity, confidence, host, and URL. Filter results with jq, for example selecting only findings where severity equals High and confidence is Certain or Firm.

Does parsing .burp files require Burp Suite Professional?

Yes, the skill delegates parsing to Burp Suite Professional and does not parse .burp files directly. You must install Burp Suite Professional plus the burpsuite-project-file-parser extension, and set the BURP_JAVA and BURP_JAR environment variables.

Why should I avoid dumping full proxy history from a Burp project?

Full proxyHistory or siteMap dumps can return gigabytes of data including response bodies, overflowing context and memory. Use sub-component filters like proxyHistory.request.headers instead, and truncate output with head -c 50000.

Why does my regex search return fewer results than expected in Burp traffic?

Response bodies may be gzip compressed, chunked, or non-UTF8 encoded, causing plaintext regex patterns to silently fail. Proxy history may also be incomplete due to Burp scope filters or intercept settings that excluded traffic.