if you've ever tried hacking web applicationyou likely have used burp suite to perform spideringproxy browser trafficand carry out other attacks recent versions of burp suite include the ability to add your own toolingcalled extensionsto burp using pythonrubyor pure javayou can add panels in the burp gui and build automation techniques into burp suite we're going to take advantage of this feature and add some handy tooling to burp for performing attacks and extended reconnaissance the first extension will enable us to utilize an intercepted http request from burp proxy as seed for creating mutation fuzzer that can be run in burp intruder the second extension will interface with the microsoft bing api to show us all virtual hosts located on the same ip address as our target siteas well as any subdomains detected for the target domain ' going to assume that you have played with burp before and that you know how to trap requests with the proxy toolas well as how to send trapped request to burp intruder if you need tutorial on how to do these tasksplease visit portswigger web security (started have to admit that when first started exploring the burp extender apiit took me few attempts to understand how it worked found it bit confusingas ' pure python guy and have limited java development experience but found number of extensions on the burp website that let me see how other folks had developed extensionsand used that prior art to help me understand how to begin implementing my own code ' going to cover some basics on extending functionalitybut 'll also show you how to use the api documentation as guide for developing your own extensions