burpsuite-project-parser — Claude Code skill: what it does, install
Explores and queries Burp Suite project files from the command line. It extracts proxy history, scanner findings, and HTTP traffic without opening the desktop app.
npx skills add trailofbits/skills --skill burpsuite-project-parser -a claude-codeWhat burpsuite-project-parser does
The skill does not parse .burp files directly. It delegates every search to Burp Suite Professional via burp-search.sh. For this script to function, your environment needs paths set in BURP_JAVA and BURP_JAR. The CLI queries also depend on the burpsuite-project-file-parser extension. Burp simply drops unrecognized flags if that extension is missing.
Output arrives as JSON. Full exports of proxy history or the site map are dangerous because response bodies quickly reach gigabytes. The skill enforces sub-component filters instead. Queries start with lightweight headers like proxyHistory.request.headers or siteMap.request.headers. Bodies should only be queried after identifying target URLs, and their length must be truncated.
Exit code handling is critical. Exit 3 means no output was produced. In headless mode, Burp produces identical silence when the parser extension is not loaded. Treating exit 3 as clean findings creates a false negative. The skill runs a bounded control query against request headers first to confirm the parser is active.
What it helps with
- query
.burpproject files for specific HTTP headers using regex - extract Burp Suite audit issues without opening the GUI
- dump filtered proxy history records safely in JSON format
- inspect site map entries while avoiding gigabyte-sized response bodies
Example prompts for the agent
- Run a search on `project.burp` using `proxyHistory.request.headers` to find all requests touching `/api/v1`.
- Extract high severity findings from `audit.burp` with the `auditItems` selector.
- Execute a control query on `target.burp` with `proxyHistory.request.headers` to verify that the parser extension is loaded.
How to install burpsuite-project-parser
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill burpsuite-project-parser -a claude-code2Manually: put the files in place
~/.claude/skills/burpsuite-project-parser/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/burpsuite-project-parser/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill burpsuite-project-parser -a codex2Manually: put the files in place
.agents/skills/burpsuite-project-parser/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill burpsuite-project-parser -a cursor2Manually: put the files in place
.cursor/skills/burpsuite-project-parser/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills burpsuite-project-parser2Manually: put the files in place
.github/skills/burpsuite-project-parser/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill burpsuite-project-parser -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/burpsuite-project-parser/skills/burpsuite-project-parserManually: put the files in place
.devin/skills/burpsuite-project-parser/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill burpsuite-project-parser -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about burpsuite-project-parser
How to install burpsuite-project-parser in Claude Code?
Run npx skills add trailofbits/skills --skill burpsuite-project-parser -a claude-code. The skill definition will be placed in ~/.claude/skills/burpsuite-project-parser/SKILL.md.
What does burpsuite-project-parser do?
It runs headless CLI searches against Burp Suite .burp files using the burp-search.sh wrapper. It filters proxy records, site maps, and vulnerability audit data into JSON.
Why does burpsuite-project-parser require Burp Suite Professional?
It relies on Burp Suite Professional and the burpsuite-project-file-parser JAR extension to parse proprietary project files. You must also set the BURP_JAVA and BURP_JAR environment variables.
