Extensions
Extend Burp.
Extensions is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Extend Burp?
Burp's core covers most testing, but extensions add capabilities — new scan checks, custom payloads, decoders, and integrations. They let you tailor Burp to specific technologies or workflows.
The BApp Store
The BApp Store (Extensions > BApp Store) is Burp's built-in marketplace of community and PortSwigger extensions. You can browse, read ratings, and install with one click.
Extensions > BApp Store > [browse] > InstallExtension Languages
Extensions are written in Java, Python (via Jython), or Ruby (via JRuby). Python and Ruby extensions require you to configure the interpreter JAR in Burp's settings first.
Settings > Extensions > Python environment
Jython JAR: /opt/jython-standalone.jarThe Montoya API
Modern Burp extensions use the Montoya API, which exposes hooks into the proxy, scanner, HTTP handlers, and UI. The older Extender API is deprecated. Extensions register handlers that Burp calls on each request/response.
Popular Extension: Logger++
Logger++ provides an advanced, filterable log of all requests across every Burp tool, with powerful search and export — far beyond the default HTTP history.
Popular Extension: Autorize
Autorize automates authorization testing. It replays requests with a low-privilege user's cookies to detect broken access control — flagging endpoints that should be forbidden but return data.
Autorize: paste low-priv Cookie header
Green = enforced, Red = bypassed authzPopular Extension: Active Scan++
Active Scan++ adds extra scan checks for issues the default scanner misses, such as host header attacks, edge-case injections, and DNS-based detections. It augments the Professional scanner.
Decoders and Custom Payloads
Extensions like Hackvertor add inline tag-based encoding/decoding and let you generate custom payloads. They are invaluable when an app uses unusual encoding or signing of parameters.
Hackvertor tag example:
<@base64><@md5>payload<@/md5><@/base64>Session Handling with Extensions
Some apps use anti-CSRF tokens or signed requests that break replay. Extensions can hook session handling rules to fetch fresh tokens or re-sign requests automatically, keeping Intruder and Scanner working.
Writing Your Own Extension
For unique needs, write a custom extension. A minimal Python extension implements registerExtenderCallbacks (legacy) or an initialize method with Montoya, then registers an HTTP handler.
def registerExtenderCallbacks(self, callbacks):
callbacks.setExtensionName("MyExt")
callbacks.registerHttpListener(self)Vetting Extensions
Extensions run with full access to your traffic and Burp project. Install only trusted ones, prefer the BApp Store, and review source where possible — a malicious extension could exfiltrate sensitive client data.
Quick Check
Match the extension to the task.
Recap
You learned to extend Burp:
- The BApp Store installs extensions in one click
- Extensions use Java or Python/Ruby via the Montoya API
- Key tools: Logger++, Autorize, Active Scan++, Hackvertor
- Only install trusted extensions — they see all your traffic
That completes the Burp Suite course.
Frequently asked questions
Is the “Extensions” lesson free?
Yes — the full text of “Extensions” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Extensions”?
Extend Burp. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Extensions” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.