Adapting Burp extensions for tailored pentesting
Summary: PortSwigger made all Burp extensions open source and gave them a similar build process, so users can modify third-party extensions rather than only use them as shipped. The post walks through customizing the Collaborator Everywhere extension by adding extra query parameters frequently vulnerable to SSRF, drawn from Bugcrowd's HUNT extension, using the Java JDK and Gradle to build the jar.
Bottom line: The author did not push his own tweak into an official release because the extra injected parameters upset quite a few websites - a reminder that a small change to a testing extension can produce unexpected side effects across the targets you point it at.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026