SILENTCHAIN AIâ„¢ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.
Knife is a feature-rich Burp Suite extension written in Java that enhances Burp's functionality through right-click context menus, automatic request modification, and additional message editor tabs. It provides tools for cookie management (update/set from history), header manipulation, host/scope additions, running external commands (SQLMap, Nmap) with request data as variables, chunked transfer encoding, URL discovery and fuzzing, Unicode-to-Chinese decoding, and information extraction (URLs, emails, IPs) from responses. The plugin uses a configurable rules engine stored as JSON to automatically add/replace/remove headers, drop or forward requests based on host/URL/keyword matches, and control scope via tool flag and URL pattern matching. Configuration is managed through a comprehensive GUI table. The codebase is well-organized with clear separation of concerns, though some deprecated classes remain. It relies on the Burp Extender API and several Apache and Google libraries.
WebTech is a Python-based tool for detecting technologies used on websites. It analyzes HTTP responses by examining headers, HTML content, meta tags, cookies, JavaScript, and URL patterns to identify web servers, frameworks, CMS, and other technologies. The tool provides both a command-line interface and a library API, with optional integration as a Burp Suite extension for active/passive scanning. Technology detection relies on a JSON-based signature database that is regularly updated from a Wappalyzer-compatible source. The architecture is modular, separating concerns into distinct modules: database management (downloading and merging signature files), HTML parsing (extracting meta tags and scripts), core detection logic (checking each technology signature across multiple vectors), and utility functions. The command-line tool processes single URLs or files containing multiple URLs, outputting results in human-readable, grep-friendly, or JSON formats. The Burp extension functions as a passive scanner, analyzing traffic intercepted by Burp Suite. While the core detection logic is well-structured and demonstrates reusable patterns, the codebase shows signs of technical debt. It maintains Python 2/3 compatibility (increasing burden as Python 2 is EOL), disables SSL verification by default (creating security risks), and the Burp extension depends on outdated Jython 2.7.0. The dependency on an external signature database introduces potential fragility if the upstream format changes. Despite these issues, the modular design allows for extraction of reusable components such as the Tech namedtuple, custom JSON encoder for sets, and HTML parser for meta/script extraction.