Burp Suite is one of the most popular tools in the tool kit of web application pen testers, used by more than 55,000 users in over 150 countries. Countless extensions are just a download away empowering pen testers to hack more efficiently to elevate web application security. But there is a constant need for new and improved extensions to keep pace with the wide range of threats facing web applications today. 

Workshop Summary

Security consultant Chris Cerne demonstrates how security professionals can significantly enhance their web application testing capabilities by creating custom Burp Suite extensions. Cerne begins by establishing Burp Suite's position as the industry-standard proxy tool for web application security testing, highlighting how its extensibility allows pentesters to address unique application challenges that standard tooling cannot solve.

Cerne shares how his journey into extension development began with client-specific needs—applications using non-standard GraphQL implementations, complex authentication schemes with rapid token expiration, and scenarios requiring automated processing of large datasets. These real-world challenges motivated him to learn extension development to solve problems that off-the-shelf extensions couldn't address. He then walks through the technical prerequisites for extension development, comparing the older Extender API with the newer, cleaner Montoya API, and making a compelling case for using JVM-based languages like Kotlin over Python, which suffers from dependency management challenges and being limited to the deprecated Python 2.7 runtime.

The presentation's core focuses on developing "BurpCage," a humorous extension that intercepts HTTP responses containing images and replaces them with random pictures of Nicolas Cage. Using this playful example, Cerne methodically demonstrates the complete extension development workflow: configuring a Kotlin project in IntelliJ IDEA, implementing the Montoya API interfaces to intercept HTTP responses, handling image replacement logic, creating a user interface with Java Swing, and packaging everything into a deployable JAR file using Gradle's shadow plugin to include all dependencies.

The session concludes with a live demonstration showing BurpCage in action, transforming Brian Krebs' security blog into an unexpected Nicolas Cage gallery, with every image from advertisements to article photos replaced with various expressions of the actor. Throughout the Q&A segment, Cerne addresses practical considerations for extension development, emphasizing the importance of separating application logic from Burp-specific code for reusability, recommending tools for UI development, and sharing insights on staying current with evolving web application threats to inform extension development priorities.

Key Takeaway

1. Custom extensions solve unique challenges - Standard extensions often can't address client-specific implementations like non-standard GraphQL endpoints or complex authentication flows, making custom development essential.
2. The Montoya API simplifies extension development - Port Swigger's newer API offers cleaner interfaces and more intuitive programming patterns compared to the older Extender API.
3. JVM languages outperform Python for extensions - While Python is popular among security professionals, its implementation in Burp (Python 2.7) creates significant limitations for dependency management and UI development.
4. Modular design enables broader application - Separating business logic from Burp-specific code allows reusing components in other security tools like OWASP ZAP.
5. Java Swing remains a necessary challenge - Despite being dated technology from the late 1990s, Swing is still required for Burp extension UIs, though tools like IntelliJ's form designer can help newcomers.
6. Dependency management requires special handling - Using Gradle's shadow plugin to create "uber JARs" ensures extensions include all required libraries, improving user experience for extension adoption.
7. Extension development skills transfer to threat response - The ability to quickly develop custom tools helps security professionals respond to emerging threats like Log4j, where standard tools may lag behind.

Who Should Watch

This technical session is ideal for:

• Web application penetration testers looking to overcome tool limitations when testing complex applications
• Security engineers with basic programming knowledge who want to automate repetitive testing tasks
• Application security professionals who need to develop custom tooling for client-specific frameworks
• Developers interested in security who want to leverage their programming skills in security testing
• Security team leads evaluating how custom tooling can improve testing efficiency and coverage

While some programming knowledge is helpful, the presentation is accessible to security professionals with limited development experience who are willing to learn through hands-on practice.