Burp Suite extension

The Burp Suite extension loads a confirmed finding into Burp so you can reproduce and extend it by hand.

For each finding you send, it:

• opens one Repeater tab per request, in the order the requests were sent, named DAST#<finding> <n>/<N> <step> (for example DAST#42 1/3 login);
• adds every request with its captured response to Organizer, with the agent's note for that step attached;
• shows the whole chain (step, method, URL, status, note) in the extension's own DAST tab.

Download and install

Download dast-burp.jar (current version 0.1.0)

Requirements: Burp Suite Professional or Community (2025.x or newer) and Java 17 or newer.

1. In Burp, open Extensions → Installed → Add.
2. Set Extension type to Java and select dast-burp.jar.
3. A new DAST tab appears in Burp's top bar.

Pair Burp with a project

A pairing code connects one Burp instance to one project.

1. In syslifters.ai, open the project and go to the Findings tab.
2. Click Generate code. The code appears in the Burp pairing code field.
3. In Burp's DAST tab, fill in:
   • DAST URL: the address you open syslifters.ai at.
   • Label (optional): a name for this Burp instance, shown next to "Burp connected" in syslifters.ai.
   • Pairing code: paste the code, or click Paste to take it from the clipboard.
4. Click Connect. The status changes to connected, and the Findings tab shows Burp connected.

Burp connects out to syslifters.ai. It opens no listener, so nothing is exposed on your machine. Burp remembers the URL, label and code and reconnects automatically after a dropped connection or a restart.

Each code belongs to one project

A code only works for the project it was generated in. Generate a new code when you switch projects, and paste it into Burp.

Send a finding to Burp

Click Burp next to a finding on the Findings tab. The button is only enabled once a pairing code is set. When Burp has loaded the requests, syslifters.ai shows how many Repeater tabs were created.

What Burp receives depends on how the finding was verified:

• Curated chain. The verifier replays every finding cleanly and marks each step. Burp receives only the requests of that replay, grouped into named steps with the agent's notes.
• Unfiltered capture. If a finding has no marked replay, Burp receives the captured traffic to the affected hosts instead, capped at 50 requests. Click Re-test on the finding to get a curated chain.

Repeater tab groups

Burp's extension API cannot create Repeater tab groups or put tabs into one. To keep the DAST#… tabs together, set Settings → Tools → Repeater → Default group for new tabs once. The shared DAST# prefix also keeps them next to each other.

Without the extension

You can download the same reproduction chain as JSON, with each request and response base64-encoded:

GET /api/findings/<finding-id>/burp-bundle/?download=1

Troubleshooting

Symptom	Cause and fix
Status shows Closed (4404 …)	The code is unknown, for example because it was mistyped or the project was deleted. Generate a new code.
Connection fails with HTTP 403	The DAST URL does not match the address syslifters.ai is served at. Use exactly the URL you open in the browser.
Findings tab shows Burp not connected	Burp is not running, the extension is unloaded, or Burp uses a different code. Check the status in Burp's DAST tab.
The Burp button is disabled	No pairing code is set on the Findings tab, or the page lost its connection. Generate a code or reload the page.
Burp shows UNFILTERED	The finding has no marked replay. Re-test the finding.