Installing extensions manually - Port Swigger
Summary: PortSwigger's documentation describes how to install Burp Suite extensions manually from a file, covering custom extensions in .jar, .py, or .rb format and .bapp files downloaded from the BApp Store for offline or closed-network use. It notes that Python and Ruby extensions require Jython or JRuby to be configured first, and that PortSwigger reviews BApp Store submissions but cannot guarantee their quality or security because they are written by third parties and can run arbitrary code.
What's compelling: Every extension you load into Burp runs arbitrary code inside a tool that sits in the middle of your traffic, and PortSwigger states plainly that its review of third-party BApp Store extensions does not come with a security guarantee - so the review before install is yours to do.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026