Troubleshooting Burp extensions - Port Swigger
Summary: PortSwigger's troubleshooting guide for Burp extensions explains that the BApp Store requires access to portswigger.net, and that intercepting proxies such as ZScaler which re-sign HTTPS certificates can cause Burp to distrust the connection until the proxy's certificate authority is added under Settings > Network > TLS. It also notes that BApp Store extensions are written by third parties and can run arbitrary code, that PortSwigger does not maintain or performance-test them, and that a CLAUDE.md file is provided so users can have an LLM review extension code.
Why it matters: Every extension pulled from the BApp Store runs arbitrary third-party code inside the tool your testers point at production, and PortSwigger states plainly that it cannot guarantee their quality or safety.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026