The Burp Suite Team Collaborator is a two-piece client/server extension for Burp Suite that allows two or more testers to share their Burp traffic, payloads, and other associated metadata with each other in real time. Introducing the Burp Suite Team Collaborator Plugin This gap in collaboration support is what my plugin aims to address. Time to re-export and share it back to you over that same process. That’s all just one way! Imagine then if I spider another host in the scope and want you to have that. These should require 2 factor logins for both you and I, along with sharing a download link. That rules out email and eats into a significant chunk of chat applications storage quotas which leaves you with just enterprise file sharing platforms. The files are massive! For projects over a few days they can be on the order of gigabytes. This certainly works but comes with a downside. Say you want to get me caught up on a project that’s already a week underway, how would you send me all those historical requests? The answer is Burp Suite’s project export functionality which exports the whole project at the time you click export and saves it for storage. Okay I kid, there’s one, but you aren’t going to like it. Thus was born the Burp Suite Team Collaborator Plugin! Current Collaboration Abilities in Burp Suite A weekend of searching later, still without a solution, I decided to take the initiative and build it myself.

It was after a particularly taxing week of testing, which required constant messaging back and forth, that I decided to look for a better solution. These co-testers are often not in close physical proximity, which means to collaborate with them I generally either use a chat service or call them on the phone. The extension and its required server can be found here: BackstoryĪs a part of my job performing application security tests for clients, I often have to work with other testers when the scope is too large for one person to handle in an acceptable time. Users can share cookies, active and passive findings, repeater payloads, and generic burp traffic to enable collaboration on application security engagements without ever leaving Burp. This Burp Suite plugin allows for two or more Burp Suite users to share web traffic, findings and specific requests in real time.

Burp suite professional training