at some point in your careeryou may find yourself attacking web application or web service that doesn' allow you to use traditional web application assessment tools whether working with binary protocol wrapped inside http traffic or complex json requestsit is critical that you are able to test for traditional web application bugs the application might be using too many parametersor it' obfuscated in some way that performing manual test would take far too much time have also been guilty of running standard tools that are not designed to deal with strange protocols or even json in lot of cases this is where it is useful to be able to leverage burp to establish solid baseline of http trafficincluding authentication cookieswhile passing off the body of the request to custom fuzzer that can then manipulate the payload in any way you choose we are going to work on our first burp extension to create the world' simplest web application fuzzerwhich you can then expand into something more intelligent burp has number of tools that you can use when you're performing web application tests typicallyyou will trap all requests using the proxyand when you see an interesting request go pastyou'll send it to another burp tool common technique use is to send them to the repeater toolwhich lets me replay web trafficas well as manually modify any interesting spots to perform more automated attacks in query parametersyou will send request to the intruder toolwhich attempts to automatically figure out which areas of the web traffic should be modifiedand then allows you to use variety of attacks to try to elicit error messages or tease out vulnerabilities burp extension can interact in numerous ways with the burp suite of toolsand in our case we'll be bolting additional functionality onto the intruder tool directly my first natural instinct is to take look at the burp api documentation to determine what burp classes need to extend in order to write my custom extension you can access this documentation by clicking the extender tab and then the apis tab this can look little daunting because it looks (and isvery java- the first thing we notice is that the developers of burp have aptly named each class so that it' easy to figure out where we want to start in particularbecause we're looking at fuzzing web requests during an intruder attacki see the iintruderpayloadgeneratorfactory and iintruderpayloadgenerator classes let' take look at what the documentation says for the iintruderpayloadgeneratorfactory class/*extensions can implement this interface and then call iburpextendercallbacks registerintruderpayloadgeneratorfactory(to register factory for custom intruder payloads *public interface iintruderpayloadgeneratorfactory /*this method is used by burp to obtain the name of the payload generator this will be displayed as an option within the intruder ui when the user selects to use extension-generated payloads @return the name of the payload generator *string getgeneratorname()/*this method is used by burp when the user starts an intruder attack that uses this payload generator