Using Burp Extender
Summary: PortSwigger published a worked example of building a Burp Extender plugin, based on a plugin by Daniele Costa that extracts HTML comments from HTTP responses and writes them to a file and the command line. The plugin implements the processProxyMessage method in IBurpExtender to get a handle on requests and responses passing through Burp Proxy, checks whether the requested URL is in scope, and uses a regular expression to match HTML comments in responses.
Why it matters: The example shows that anyone with basic Java skills can write a plugin that reads every in-scope response passing through Burp Proxy and writes the extracted HTML comments to disk - a reminder that the tooling sitting in the middle of your traffic is only as trustworthy as the extensions loaded into it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026