burp-zap-hardened

SKILL: Burp MCP Query Patterns

This skill defines how to effectively query Burp Suite via MCP to extract relevant security data.

MCP Tool Reference

Core Tools

Tool	Purpose	When to Use
get_proxy_history	Retrieve all intercepted HTTP traffic	Phase 2 triage, Phase 3 analysis
get_sitemap	Get hierarchical site structure	Initial reconnaissance
get_scope	View Burp's scope configuration	Scope validation
send_to_repeater	Queue request for manual testing	Follow-up on findings
send_to_intruder	Queue request for automated testing	Fuzzing, enumeration

Query Strategies

Strategy 1: Bulk Retrieval (Triage Phase)

When triaging, get everything in scope first, then filter locally:

# Get all proxy history
result = get_proxy_history()

# Filter in your analysis:
# - By host (scope.target)
# - By path (scope.include patterns)
# - Exclude noise (scope.exclude patterns)

Why: Single query, local filtering is faster than many filtered queries.

Strategy 2: Targeted Retrieval (Analysis Phase)

When analyzing specific indicators, query for relevant patterns:

# For IDOR analysis - get requests with ID patterns
# Look for: /users/123, /orders/456, ?id=789

# For Auth analysis - get auth-related endpoints
# Look for: /login, /auth, /token, /session, Authorization headers

# For SSRF - get requests with URL parameters
# Look for: url=, redirect=, callback=, next=

Strategy 3: Comparative Retrieval (Multi-Context Testing)

When testing authorization, compare requests across user contexts:

# Identify requests with auth tokens
# Group by endpoint
# Compare: Same endpoint + Different auth = Different response?

Data Structure Reference

Proxy History Entry

Each entry from get_proxy_history typically contains:

{
  "id": 1234,
  "host": "api.example.com",
  "port": 443,
  "protocol": "https",
  "method": "GET",
  "path": "/api/users/123",
  "request": {
    "headers": [...],
    "body": "..."
  },
  "response": {
    "status_code": 200,
    "headers": [...],
    "body": "..."
  },
  "timestamp": "2024-01-15T10:30:00Z"
}