screenshot-burp

Screenshot: Burp Repeater request/response PoC

Turn a Burp Repeater exchange into a report-ready request + response image. This is the Burp-native counterpart to Skill(screenshot) (curl/terminal cards): when you drive a target through Burp, capture the proof FROM Burp. Prereqs are the same as Skill(hunt-burp) (Burp running + the MCP Server BApp, SSE on 127.0.0.1:9876; verify with bash /root/vm.sh 'python3 ~/burp-mcp-cli.py list').

One command (use this)

scripts/capture.sh burp <eng> <slug> <host> <port> <https:true|false> <method> <path> [bodyfile] [tabname]
# POST with a body file (forged/complex bodies -> write to a file, avoids shell quoting):
scripts/capture.sh burp thm_x flag1 10.1.1.1 5000 true  POST /login /tmp/login_body.txt "ECorp login"
# simple GET:
scripts/capture.sh burp thm_x flag3 10.1.1.1 3000 false GET  /challenge/solve

It: (1) create_repeater_tab via the MCP with the raw request, (2) activates Burp on the seat display, focuses the request editor, sends with Ctrl+Space (Burp's Repeater Send hotkey), (3) import-grabs the window and pulls targets/<eng>/poc/NN-<slug>.png, printing the ![]() ref. Drop that ref into walkthrough.md so the image actually renders in Obsidian (an un-referenced PNG in poc/ is invisible in the notes - only reachable by opening the folder).

Crypto-forged / signed requests: give the exploit script a --curl-style mode that writes the exact body to a file (e.g. /tmp/login_body.txt), then pass it as bodyfile. The Repeater tab then holds the real forged request, so the PoC is Burp-native and reproducible.

Gotchas baked into capture.sh burp (the burp mode) (why hand-rolling this failed the first time)

• Grab as the SEAT user, not root. Burp may be root-owned but it DRAWS on the desktop user's X session (the desktop login on :0). who -> the line with a (:N) display gives the user + display; use their ~/.Xauthority. A root-over-SSH grab has no X display.
• Send = Ctrl+Space (KEYBOARD only); mouse is dead. Java Swing IGNORES synthetic xdotool MOUSE clicks (button/tab/pixel clicks are silent no-ops), but KEYBOARD events land once the window is activated (windowactivate --sync): Ctrl+Shift+R (focus Repeater), Ctrl+= (next sub-tab), Ctrl+Space (Send). Drive everything by keyboard; anything with no hotkey (e.g. the BApp MCP tab) needs a human mouse action.
• Window offset: getwindowgeometry -> the client area sits at screen (0, ~35); the import -window grab starts at the client top, so screen_y = image_y + 35 (only matters if you ever DO need a click on a WM that accepts synthetic clicks; this one does not).
• Write the grab to a WORLD-WRITABLE path (/tmp/capture_burp_*.png), never a root-owned -o dir: the sudo-as-seat-user import can't write into /tmp/poc if root created it (silent EACCES = "no PNG").
• The "SSE wedge" was a MISDIAGNOSIS (corrected 2026-07-24). The only MCP call that ever hung is send_http1_request, and that is the extension's target-approval gate (a non-approved target raises a GUI approval prompt a headless seat cannot answer -> 15s timeout), NOT a per-session wedge. create_repeater_tab, get_active_editor_contents, url_encode, set_proxy_intercept_state all run fine across many back-to-back per-call sessions. capture.sh burp never calls send_http1_request (it Sends in the GUI via Ctrl+Space, human-equivalent, which bypasses the approval gate), so it is unaffected. If create_repeater_tab itself fails, the server is down/unreachable -> check scripts/burp/burp-transport.sh (see [[burp-mcp]]).