Burp Suite bridge

Move a request between Burp Suite and VirtuProbe in either direction. Send something you captured in Burp over as an HTTP probe, or take a probe you built in VirtuProbe and open it in Repeater to work on it by hand.

Once a request is in VirtuProbe it behaves like any probe you authored yourself, so you get variables, chains, extractors and the fuzzer.

Turn the bridge on first

The bridge is off by default, and VirtuProbe refuses a request from the extension until you enable it. Open Settings, find the Burp Suite bridge section, and switch on Enable the Burp Suite bridge. Turn it off again when you are done.

Note

Until the bridge is enabled, Send to VirtuProbe returns an error asking you to switch it on in Settings.

Get the extension

Download the extension: virtuprobe-bridge.jar.

The extension is open source under the MIT license, so you can read what it does before you load it into Burp, and build it yourself if you would rather run your own jar: github.com/foobar-beer/virtuprobe-burp-extension.

Once you have the extension jar:

1. In Burp Suite, open the Extensions tab (Extensions → Installed).
2. Click Add.
3. Set Extension type to Java.
4. Select the VirtuProbe extension jar and confirm.

The extension adds a VirtuProbe tab to Burp. It points at 127.0.0.1:10100, which is where a desktop install listens on the same machine, and you only need to change it if you moved the port or your execution server runs elsewhere. Test connection tells you whether VirtuProbe is answering and whether the bridge is switched on.

Send a request into VirtuProbe

Right-click a request in Burp, in the proxy history, the target site map or the repeater, and choose Send to VirtuProbe. Select several requests first and the menu offers to send them all together.

A dialog asks where the request should land:

• Project and Bundle pick the destination. The bundle list shows what that project can see, and + New bundle… creates one for the capture.
• Mode is either Structured, which fills in the method, URL, headers and body as editable fields, or Verbatim, which keeps the exact bytes Burp captured with nothing normalized on the way in. Verbatim is what you want when the precise shape of the request is the point.
• Also create a regression test asserting this status builds a one-step chain beside the probe. It runs the request and asserts the same response status Burp saw, so something you found by hand becomes something you can run again on demand, in a suite, and in your CI/CD processes.

The dialog opens on whatever you chose last time, including across a Burp restart, so sending a series of captures into the same bundle does not mean choosing it again each time.

Note

The regression test needs a response to work from, so it is offered for a single request and only when Burp captured one. Without a response the probe still imports and no test is created.

Send a probe back to Burp

In the VirtuProbe Explorer, right-click an HTTP probe and open Send to Burp. VirtuProbe resolves the probe against your active environment first, so {{variables}} arrive filled in rather than as placeholders. Pick where it goes:

• Repeater opens it in a new tab, named after the probe.
• Intruder does the same, ready for you to mark payload positions.
• Organizer parks it in your Organizer list.
• Site map files the URL under Target without sending anything.

Burp collects these while Listen for Send to Burp from VirtuProbe is switched on in the VirtuProbe tab, which is the default. With it off, VirtuProbe queues the request and nothing arrives.

Caution

Only send requests for systems you are authorized to test. The bridge moves a request from one tool to another on your own machine. It does not change who you are allowed to point it at.