Burp Suite

Burp MCP + Codex CLI

This guide shows how to connect Burp Suite MCP Server to Codex CLI so that Codex can reason directly on your real HTTP traffic — no API keys, no scanning, no fuzzing.

You end up with a reasoning engine wired directly into your interception stack.

What you get

• Passive vuln discovery

• IDOR / auth bypass / SSRF / logic flaw detection

• Report writing from real Burp evidence

• No API keys

• Full local traffic control

1. Install Burp MCP Server

Install MCP Server from Burp’s BApp Store.

Once installed, open its tab and click:

Extract server proxy jar

This downloads:

mcp-proxy.jar

This is the stdio MCP bridge Codex uses.

2. Configure Codex MCP

Edit:

~/.codex/config.toml

Append:

[mcp_servers.burp]
command = "java"
args = ["-jar", "/absolute/path/to/mcp-proxy.jar", "--sse-url", "http://127.0.0.1:19876"]

3. Install Caddy reverse proxy

Burp MCP currently enforces strict Origin validation and rejects extra headers sent by Codex, which causes handshake failures see more here.

We solve this with a local reverse proxy.

Install Caddy:

brew install caddy

4. Create the Caddyfile

Create:

~/burp-mcp/Caddyfile

Paste:

:19876

reverse_proxy 127.0.0.1:9876 {
  # Match Origin and Host exactly (anti-DNS rebinding)
  header_up Host "127.0.0.1:9876"
  header_up Origin "http://127.0.0.1:9876"

  # Workaround for current Burp MCP SSE 403 bug
  header_up -User-Agent
  header_up -Accept
  header_up -Accept-Encoding
  header_up -Connection
}

5. Start everything

caddy run --config ~/burp-mcp/Caddyfile &
codex

Verify:

/mcp

You should see:

6. Test it

Examples:

From Burp history, find all endpoints that use numeric IDs and lack Authorization headers.

Using Burp MCP, identify potential IDOR endpoints and suggest safe confirmation steps.

From Burp data, write a vulnerability report with reproduction, impact and remediation.

7. One-command launcher (optional)

Add to your ~/.zshrc (check your paths first):

burpcodex() {
  emulate -L zsh
  setopt pipefail

  local CADDYFILE="$HOME/burp-mcp/Caddyfile"
  local LOG="/tmp/burp-mcp-caddy.log"
  local CADDY_PID=""

  if ! command -v caddy >/dev/null 2>&1; then
    echo "[!] caddy not found (brew install caddy)"
    return 1
  fi
  if ! command -v codex >/dev/null 2>&1; then
    echo "[!] codex not found in PATH"
    return 1
  fi
  if [[ ! -f "$CADDYFILE" ]]; then
    echo "[!] Caddyfile not found: $CADDYFILE"
    return 1
  fi

  cleanup() {
    # 1) Kill captured PID (if still alive)
    if [[ -n "$CADDY_PID" ]] && kill -0 "$CADDY_PID" 2>/dev/null; then
      kill -TERM "$CADDY_PID" 2>/dev/null
      sleep 0.2
      kill -KILL "$CADDY_PID" 2>/dev/null
      wait "$CADDY_PID" 2>/dev/null
    fi

    # 2) Fallback: kill anything still listening on 19876
    local pids
    pids="$(lsof -ti tcp:19876 2>/dev/null | tr '\n' ' ')"
    if [[ -n "$pids" ]]; then
      kill -TERM $pids 2>/dev/null
      sleep 0.2
      kill -KILL $pids 2>/dev/null
    fi
  }

  trap 'cleanup; return 130' INT TERM
  trap 'cleanup' EXIT

  # Start caddy
  caddy run --config "$CADDYFILE" >"$LOG" 2>&1 &
  CADDY_PID=$!
  echo "[*] Caddy started (pid=$CADDY_PID) - log: $LOG"

  # Run codex (foreground)
  command codex "$@"

  # Ensure cleanup even if trap didn't trigger for some reason
  cleanup
  trap - INT TERM EXIT
}

Run:

burpcodex

Tips

- If Render Page crash:
sudo sysctl -w kernel.unprivileged_userns_clone=1

- If embedded browser crash due sandbox:
find .BurpSuite -name chrome-sandbox -exec chown root:root {} \; -exec chmod 4755 {} \;

- Scope with all subdomains:
.*\.test\.com$

- Use Intruder to target specific parameters for scanning 
  - Right click: actively scan defined insertion points 

# Configuration
- Project Options -> HTTP -> Redirections -> Enable JavaScript-driven
- User Options -> Misc -> Proxy Interception -> Always disabled
- Target -> Site Map -> Show all && Show only in-scope items

# XSS Validator extension
1) Start xss.js phantomjs $HOME/.BurpSuite/bapps/xss.js
2) Send Request to Intruder
3) Mark Position 
4) Import xss-payload-list from $Tools into xssValidator
5) Change Payload Type to Extension Generated
6) Change Payload Process to Invoke-Burp Extension - XSS Validator
7) Add Grep-Match rule as per XSS Validator
8) Start.

# Filter the noise
https://gist.github.com/vsec7/d5518a432b70714bedad79e4963ff320

# Filter the noise TLDR
# TLS Pass Through
.*\.google\.com
.*\.gstatic\.com
.*\.googleapis\.com
.*\.pki\.goog
.*\.mozilla\.com

# Send swagger to burp
https://github.com/RhinoSecurityLabs/Swagger-EZ
# Hosted: 
https://rhinosecuritylabs.github.io/Swagger-EZ/

# If some request/response breaks or slow down Burp
- Project options -> HTTP -> Streaming responses -> Add url and uncheck "Store streaming responses...."

# Burp Extension rotate IP yo avoid IP restrictions
https://github.com/RhinoSecurityLabs/IPRotate_Burp_Extension

# Collab/SSRF/pingback alternative
interactsh.com
ceye.io
requestcatcher.com
canarytokens.org
webhook.site
ngrok.com
pingb.in
swin.es
requestbin.net
ssrftest.com
rbnd.gl0.eu
dnslog.cn
beeceptor.com

# Run private collaborator instance in AWS
https://github.com/Leoid/AWSBurpCollaborator

# Run your own collab server
https://github.com/yeswehack/pwn-machine

# Wordlist from burp project file
cat project.burp | strings | tok | sort -u > custom_wordlist.txt

# Autorize:
  1. Copy cookies from low priv user and paste in Autorize
  2. Set filters (scope, regex)
  3. Set Autorize ON
  4. Navigate as high priv user
  
# Turbo Intruder
basic.py -> Set %s in the injection point and specify wordlist in script
multipleParameters.py -> Set %s in all the injection points and specify the wordlists in script

# Match and Replace
https://github.com/daffainfo/match-replace-burp

# Customize Audit Scans
Configure your audit profile -> Issues reported -> Individual issues -> right-click on "Extension generated issues" -> "Edit detection methods"
Works on most of issues like SQLi

# Send to local Burp from VPS
# In local computer
ssh -R 8080:127.0.0.1:8080 root@VPS_IP -f -N
# In VPS
curl URL -x http://127.0.0.1:8080

# Ip rotation
https://github.com/ustayready/fireprox

Proxy options

Append something to the user-agent

Match `^User-Agent: (.*)$`

Replace `User-Agent: $1 BugBounty-Username`

Preferred extensions

Make Burp Suite your own: high-powered extensibility to customize and enhance your testing. 🛠️PortSwigger Blog

GitHub - Ignitetechnologies/BurpSuite-For-Pentester: This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite".GitHub

Burp Bounty Pro: Active and passive checks customizable based on patterns.
Active Scan ++ More active and passive scans.
Software Vulnerability Scanner Passive scan to detect vulnerable software versions
Param Miner Passive scan to detect hidden or unlinked parameters, cache poisoning
Backslash Powered Scanner Active scan for SSTI detection
CSRF Scanner Passive CSRF detection
Freddy Active and Passive scan for Java and .NET deserialization
JSON Web Tokens decode and manipulate JSON web tokens
Reissue Request Scripter generates scripts for Python, Ruby, Perl, PHP and PowerShell
Burp-exporter other extension for export request to multiple languages
Retire.js Passive scan to find vulnerable JavaScript libraries
Web Cache Deception Scanner Active scan for Web Cache Deception vulnerability
Cookie decrypter Passive check for decrypt/decode Netscaler, F5 BigIP, and Flask cookies
Reflector Passive scan to find reflected XSS
J2EEScan Active checks to discover different kind of J2EE vulnerabilities
HTTP Request Smuggler Active scanner and launcher for HTTP Request Smuggling attacks
Flow History of all burp tools, extensions and tests
Taborator Allows Burp Collaborator in a new tab
Turbo Intruder Useful for sending large numbers of HTTP requests (Race cond, fuzz, user enum)
Auto Repeater Automatically repeats requests with replacement rules and response diffing
Upload Scanner Tests multiple upload vulnerabilities
poi Slinger: Active scan check to find PHP object injection
Java Deserialization Scanner Active and passive scanner to find Java deserialization vulnerabilities
Autorize Used to detect IDORs
Match/Replace Session Action Provides a match and replace function as a Session Handling Rule.
.NET Beautifier Easy view for VIEWSTATE parameter
Wsdler generates SOAP requests from WSDL request
Collaborator Everywhere Inject headers to reveal backend systems by causing pingbacks
Collabfiltrator Exfiltrate blind remote code execution output over DNS
Bypass WAF Add some headers to bypass some WAFs
SAMLRaider for testing SAML infrastructures, messages and certificates
GoldenNuggets-1 create wordlists from target
Logger++ Log for every burp tool and allows highlight, filter, grep, export...
OpenAPI Parser Parse and fetch OpenAPI documents directly from a URL
CO2: Multiple functions such sqlmapper, cewler
XSSValidator: XSS intruder payload generator and checker
Shelling: command injection payload generator
burp-send-to: Adds a customizable "Send to..."-context-menu.
ssrf-king: Automates SSRF detection