/hunt-burp

name: hunt-burp
description: Drive Burp Suite over its MCP server as an AI triage + attack layer - review proxy history for signals, replay via Repeater/send, OOB-gate blind bugs with Collaborator, fuzz via Intruder (RoE-safe), then hand off to the matching vuln-class hunt. Wiki-first, FIND schema output.

Hunt: Burp Suite via MCP

Force-multiplier skill. Burp is the transport + triage layer; the vuln-class `hunt-*` skills carry the methodology. Use when Burp is running with the MCP Server extension and you want the model to read captured traffic and drive Burp directly.

Pre-Attack: Wiki Query (MANDATORY)

qmd_query "burp mcp proxy history repeater collaborator" via wiki-search MCP -> read matches.

Core pages: [[burp-mcp]] (setup + tool inventory + workflow), [[burp-suite]] (GUI + BApps). **Self-heal:** query empty -> read `wiki/tools/burp-mcp.md` directly.

On the box (prereqs)

• Kali runs Burp + the "MCP Server" BApp; SSE at `127.0.0.1:9876`. Community works (loses Collaborator + Scanner). Full setup + BApp loadout: [[burp-mcp]].
• **Resolve the transport ONCE (run this first). PREFER NATIVE; the CLI bridge is the fallback:**
• **Native (PREFERRED):** the `burp` MCP server is registered on the host (`/root/vm-mcp-burp.sh` -> SSH -> `mcp-proxy.jar --sse-url :9876`), so the real `mcp__burp__*` tools appear natively. **Check first:** `ToolSearch("select:mcp__burp__create_repeater_tab,mcp__burp__send_http1_request")`. If they load -> USE THEM (cleanest; no double-base64 quoting); export `BURP_NATIVE=1` if you also shell out.
• **Absent? classify with the resolver:** `bash scripts/burp/burp-transport.sh` prints `bridge` (VM+Burp up, use the CLI below) or `down` (**the VM was almost certainly DOWN at session start** so the native server never attached -- it only connects at startup and does not auto-reconnect; recovery is bring the VM+Burp up then **RESTART the session**, or use the bridge if a restart is unacceptable).
• **Bridge (FALLBACK):** run the CLI on Kali over the SSH bridge:

bash /root/vm.sh 'python3 ~/burp-mcp-cli.py list'                          # tools up? empty = server/port down
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py schema get_proxy_http_history' # a tool's input schema
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py call get_proxy_http_history "{\"count\":50}"'

(push `scripts/burp/burp-mcp-cli.py` to `~/` on Kali once, or forward 9876 and run it locally with `BURP_MCP_URL` set; see [[burp-mcp]].) Each `call` opens a fresh SSE session, which is fine -- the old "wedges after ~1 call" was really the approval gate on `send_http1_request` (see the scope bullet).

• **Sync scope ONCE (makes in-scope MCP sends auto-approve):** `python3 scripts/burp/burp-scope-sync.py` pushes `targets/<eng>/scope.md` into Burp's project scope. The MCP extension AUTO-APPROVES in-scope targets, so native `mcp__burp__send_*` to in-scope hosts then flow headless; out-of-scope sends stay gated on the GUI approval prompt a headless seat cannot answer (a `send_http1_request` that "hangs" IS that gate, not a wedge). This is also the scope gate for native MCP calls, which `scope-guard.py` (PreToolUse/Bash) never sees.

Anti-drift: DRIVE Burp, don't just proxy through it (and don't stop at foothold)

`curl -x 127.0.0.1:8080` lands in Proxy history but is NOT "using Burp" -- the operator gets no per-request visual. Every LOAD-BEARING request -> a **Repeater** tab (`create_repeater_tab`); every brute/fuzz -> **Intruder** (`send_to_intruder`, sniper/battering-ram), never a hand-rolled loop -- so the operator watches it fire live. **Burp-first does NOT end at RCE/shell:** the recurring drift is landing a foothold then scripting the entire post-exploitation over raw `curl`/`vm.sh`/urllib, so the operator loses sight of it. Keep the requests that matter (the authed API call, the injection that reads the flag, each privesc fetch) in Repeater to the end of the box. Quick throwaway loops over the bridge are fine; the requests you'd screenshot are not throwaway -> Repeater.

Drive each Burp tool (native name -> what it is for)

Every load-bearing action has a tool; reach for it instead of a raw request so the operator watches it live. (Authoritative 27-tool surface: `PortSwigger/mcp-server` `Tools.kt`.)

• **Repeater** (one tab per load-bearing request, named after the finding): `create_repeater_tab` (HTTP/1.1), `create_repeater_tab_http2` (default for HTTP/2 targets). Automated diffing: `send_http1_request`/`send_http2_request`. Note: creating a tab does NOT focus it and there is no tab-select tool (see `Skill(screenshot-burp)` for the burpshot tab-verify).
• **Intruder** (every brute/fuzz -- login brute, OTP brute, param sweep -- NEVER a hand-rolled loop): `send_to_intruder`, then set positions + attack type in the GUI (sniper / battering-ram / pitchfork / cluster-bomb). RoE: anti-lockout + `no_bruteforce` still apply (default/known creds first).
• **Collaborator** (blind OOB -- SSRF/XXE/SQLi/cmdi): `generate_collaborator_payload` -> inject -> `get_collaborator_interactions` (poll by payloadId). Community (no Collaborator) -> interactsh per [[oob-callbacks]].
• **Decoder / encode utils** (WAF bypass, payload prep): `url_encode`/`url_decode`, `base64_encode`/`base64_decode`, `generate_random_string`. Nest encodings when the app decodes server-side.
• **Active editor:** `get_active_editor_contents` (read the focused request/response -- also the way to confirm WHICH Repeater tab is focused before a burpshot, since no tab-select tool exists), `set_active_editor_contents` (write it).
• **Triage reads:** `get_proxy_http_history`(`_regex`), `get_proxy_websocket_history`(`_regex`), `get_organizer_items`(`_regex`), `get_scanner_issues` (Pro).
• **Comparer:** no MCP tool -- diff two responses in Repeater or by hand.
• **match-replace + scope + intercept + task-engine:** config via `set_user_options` / `set_project_options` (JSON merge; export the schema first with `output_user_opti