Hunt Burp

Hunt: Burp Suite via MCP

Force-multiplier skill. Burp is the transport + triage layer; the vuln-class hunt-* skills carry the methodology. Use when Burp is running with the MCP Server extension and you want the model to read captured traffic and drive Burp directly.

Pre-Attack: Wiki Query (MANDATORY)

qmd_query "burp mcp proxy history repeater collaborator" via wiki-search MCP -> read matches.

Core pages: [[burp-mcp]] (setup + tool inventory + workflow), [[burp-suite]] (GUI + BApps). Self-heal: query empty -> read wiki/tools/burp-mcp.md directly.

On the box (prereqs)

• Kali runs Burp + the "MCP Server" BApp; SSE at 127.0.0.1:9876. Community works (loses Collaborator + Scanner). Full setup + BApp loadout: [[burp-mcp]].
• Resolve the transport ONCE (run this first). PREFER NATIVE; the CLI bridge is the fallback:
  • Native (PREFERRED): the burp MCP server is registered on the host (/root/vm-mcp-burp.sh -> SSH -> mcp-proxy.jar --sse-url :9876), so the real mcp__burp__* tools appear natively. Check first: ToolSearch("select:mcp__burp__create_repeater_tab,mcp__burp__send_http1_request"). If they load -> USE THEM (cleanest; no double-base64 quoting); export BURP_NATIVE=1 if you also shell out.
  • Absent? classify with the resolver: bash scripts/burp/burp-transport.sh prints bridge (VM+Burp up, use the CLI below) or down (the VM was almost certainly DOWN at session start so the native server never attached -- it only connects at startup and does not auto-reconnect; recovery is bring the VM+Burp up then RESTART the session, or use the bridge if a restart is unacceptable).
  • Bridge (FALLBACK): run the CLI on Kali over the SSH bridge:

bash /root/vm.sh 'python3 ~/burp-mcp-cli.py list'                          # tools up? empty = server/port down
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py schema get_proxy_http_history' # a tool's input schema
bash /root/vm.sh 'python3 ~/burp-mcp-cli.py call get_proxy_http_history "{\"count\":50}"'

(push `scripts/burp/burp-mcp-cli.py` to `~/` on Kali once, or forward 9876 and run it locally with `BURP_MCP_URL` set; see [[burp-mcp]].) Each `call` opens a fresh SSE session, which is fine -- the old "wedges after ~1 call" was really the approval gate on `send_http1_request` (see the scope bullet).

• Sync scope ONCE (makes in-scope MCP sends auto-approve): python3 scripts/burp/burp-scope-sync.py pushes targets/<eng>/scope.md into Burp's project scope. The MCP extension AUTO-APPROVES in-scope targets, so native mcp__burp__send_* to in-scope hosts then flow headless; out-of-scope sends stay gated on the GUI approval prompt a headless seat cannot answer (a send_http1_request that "hangs" IS that gate, not a wedge). This is also the scope gate for native MCP calls, which scope-guard.py (PreToolUse/Bash) never sees.

Anti-drift: DRIVE Burp, don't just proxy through it (and don't stop at foothold)

curl -x 127.0.0.1:8080 lands in Proxy history but is NOT "using Burp" -- the operator gets no per-request visual. Every LOAD-BEARING request -> a Repeater tab (create_repeater_tab); every brute/fuzz -> Intruder (send_to_intruder, sniper/battering-ram), never a hand-rolled loop -- so the operator watches it fire live. Burp-first does NOT end at RCE/shell: the recurring drift is landing a foothold then scripting the entire post-exploitation over raw curl/vm.sh/urllib, so the operator loses sight of it. Keep the requests that matter (the authed API call, the injection that reads the flag, each privesc fetch) in Repeater to the end of the box. Quick throwaway loops over the bridge are fine; the requests you'd screenshot are not throwaway -> Repeater.

Drive each Burp tool (native name -> what it is for)

Every load-bearing action has a tool; reach for it instead of a raw request so the operator watches it live. (Authoritative 27-tool surface: PortSwigger/mcp-server Tools.kt.)

• Repeater (one tab per load-bearing request, named after the finding): create_repeater_tab (HTTP/1.1), create_repeater_tab_http2 (default for HTTP/2 targets). Automated diffing: send_http1_request/send_http2_request. Note: creating a tab does NOT focus it and there is no tab-select tool (see Skill(screenshot-burp) for the burpshot tab-verify).
• Intruder (every brute/fuzz -- login brute, OTP brute, param sweep -- NEVER a hand-rolled loop): send_to_intruder, then set positions + attack type in the GUI (sniper / battering-ram / pitchfork / cluster-bomb). RoE: anti-lockout + no_bruteforce still apply (default/known creds first).
• Collaborator (blind OOB -- SSRF/XXE/SQLi/cmdi): generate_collaborator_payload -> inject -> get_collaborator_interactions (poll by payloadId). Community (no Collaborator) -> interactsh per [[oob-callbacks]].
• Decoder / encode utils (WAF bypass, payload prep): url_encode/url_decode, base64_encode/base64_decode, generate_random_string. Nest encodings when the app decodes server-side.
• Active editor: get_active_editor_contents (read the focused request/response -- also the way to confirm WHICH Repeater tab is focused before a burpshot, since no tab-select tool exists), set_active_editor_contents (write it).
• Triage reads: get_proxy_http_history(_regex), get_proxy_websocket_history(_regex), get_organizer_items(_regex), get_scanner_issues (Pro).
• Comparer: no MCP tool -- diff two responses in Repeater or by hand.
• match-replace + scope + intercept + task-engine: config via set_user_options / set_project_options (JSON merge; export the schema first with output_user_options / output_project_options). Intercept on/off: set_proxy_intercept_state; scanner/engine pause: set_task_execution_engine_state.

Passive-first candidate sweep (do this BEFORE active testing)

Pull get_proxy_http_history(_regex) and route each signal to its hunt, do not attack blind:

MCP toolset (what to reach for)

• Triage: get_proxy_http_history(_regex), get_proxy_websocket_history(_regex), get_organizer_items(_regex), get_scanner_issues (Pro)
• Replay/probe: send_http1_request, send_http2_request, create_repeater_tab(_http2), send_to_intruder
• OOB (Pro): generate_collaborator_payload, get_collaborator_interactions
• Utils: url_encode/url_decode, base64_encode/base64_decode, generate_random_string, get/set_active_editor_contents
• Control: set_proxy_intercept_state, set_task_execution_engine_state, output/set_project_options, output/set_user_options