AI analysis in Burp. Your choice of model.
Turn HTTP traffic into leads for your next security test, directly inside Burp Suite Professional. Keep control of where your traffic is processed: run models locally through Ollama or on infrastructure you control. Prefer a hosted provider? Connect a supported model API.
£79/year · Activate on up to 3 devices.
GPT-generated insights
- Severity
- Information
- Confidence
- Tentative
Potential account takeover
Account lookup returns passwordResetToken for the requested email address. A valid token could let someone reset that account’s password.
Suggested next test
Using a test account, check whether the returned token can complete a password reset without email verification.
Built for engagements where data matters.
Run models on your own infrastructure
Analyse sensitive traffic with local models through Ollama or a compatible self-hosted endpoint. Keep model processing on your machine or infrastructure you control.
Reuse your testing approach
Build a prompt library for recurring checks and share prompts through import and export. Traffic placeholders supply the request and response context for each analysis.
Keep insights beside the evidence
Inspect AI-generated insights alongside the original requests and responses in Burp's issue workflow, ready for validation and triage.
Three ways to analyse your traffic.
Analyse selected HTTP requests and responses individually or in batches, add AI scan checks to Burp's active scans, or ask questions about your traffic in AI Chat.
Give selected traffic a focused second look.
Select one or more HTTP requests and responses in Burp, run AI analysis, and review the generated insights alongside the original traffic.
Start local. Choose your provider.
Connect a local model through Ollama, a self-hosted endpoint, or a supported hosted provider. Choose your model and fine-tune its request parameters to suit your analysis. Your configuration powers both scanning and chat.
Explore supported providers →- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Connection
- Model provider
- Ollama
- Base URL
- http://localhost:11434
Model
- Model name
- gemma3
Request parameters
{
"temperature": 0.2,
"max_tokens": 1024
}Guide each check with engagement-specific instructions.
For targeted analysis and active scans, write a prompt directly in the AI scanner settings or load one from the prompt library, where you can create, edit, import, and export reusable prompts. Use the placeholder reference to include request, response, URL, method, header, or body context in each analysis.
- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Prompt
- Role
- user
Review this exchange for access-control weaknesses. Separate evidence from follow-up tests.
Request
{REQUEST}
Response
{RESPONSE}
Analyse one request or a batch of selected traffic.
Select one or more requests, then use Scan with AI from the Extensions context menu. Each selected request and its response get a separate analysis using your configured provider and prompt. Targeted analysis works whether active scanning is enabled or disabled.
Read the targeted analysis guide →| Method | URL | Status |
|---|---|---|
| Selected request: GET | /api/account?userId=1042 | 200 |
| Selected request: GET | /api/orders | 200 |
| POST | /api/session | 204 |
GET /api/account?userId=1042 HTTP/1.1
Host: example.test
Accept: application/jsonSend to Repeater
Extensions
BurpGPT Pro
Scan with AI (results in Target → Site map)
Keep the analysis beside its evidence.
Find GPT-generated insights in Target → Site map with the original exchange. Severity is informational and confidence is tentative.
Understand generated insights →GPT-generated insights
- Severity
- Information
- Confidence
- Tentative
The following insight was generated:
Potential cross-account data access
GET /api/account?userId=1042 returns account details selected by a client-supplied userId. If the server does not check ownership, another user could read this account’s data.
Suggested next test
Using two test accounts, send account B’s userId with account A’s session. If B’s details are returned, capture both exchanges as evidence.
Bring your prompts into active scans.
Configure your provider and scanner prompt first, then enable AI scan checks and review AI-generated insights in Burp.
Start local. Choose your provider.
Connect a local model through Ollama, a self-hosted endpoint, or a supported hosted provider. Choose your model and fine-tune its request parameters to suit your analysis. Your configuration powers both scanning and chat.
Explore supported providers →- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Connection
- Model provider
- Ollama
- Base URL
- http://localhost:11434
Model
- Model name
- gemma3
Request parameters
{
"temperature": 0.2,
"max_tokens": 1024
}Guide each check with engagement-specific instructions.
For targeted analysis and active scans, write a prompt directly in the AI scanner settings or load one from the prompt library, where you can create, edit, import, and export reusable prompts. Use the placeholder reference to include request, response, URL, method, header, or body context in each analysis.
- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Prompt
- Role
- user
Review this exchange for access-control weaknesses. Separate evidence from follow-up tests.
Request
{REQUEST}
Response
{RESPONSE}
Bring AI analysis into your active scans.
After configuring your provider and prompt, use Scan: On to enable checks scheduled by Burp. This does not start a scan; targeted analysis and AI Chat remain available independently.
Read the active scanning guide →- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Active scan
Enable or disable AI-powered active scanning. Analysis may start later depending on the selected checks and Burp's scheduling.
Triage generated insights in Burp.
Review each informational, tentative issue alongside its HTTP exchange.
Understand generated insights →GPT-generated insights
- Severity
- Information
- Confidence
- Tentative
The following insight was generated:
Potential cross-account data access
GET /api/account?userId=1042 returns account details selected by a client-supplied userId. If the server does not check ownership, another user could read this account’s data.
Suggested next test
Using two test accounts, send account B’s userId with account A’s session. If B’s details are returned, capture both exchanges as evidence.
Follow the question behind the response.
Choose traffic context, ask your question, and continue the investigation inside Burp.
Start local. Choose your provider.
Connect a local model through Ollama, a self-hosted endpoint, or a supported hosted provider. Choose your model and fine-tune its request parameters to suit your analysis. Your configuration powers both scanning and chat.
Explore supported providers →- Provider settings
- AI scanner
- Placeholder reference
- Prompt library
Connection
- Model provider
- Ollama
- Base URL
- http://localhost:11434
Model
- Model name
- gemma3
Request parameters
{
"temperature": 0.2,
"max_tokens": 1024
}Decide what accompanies your next question.
Include the current request, response, or both with your next message. Request and Response are deselected when you send a message. Previously included traffic can remain in the conversation context.
Learn how chat context works →Start a conversation
Ask about the current HTTP request or response.
Send a focused question from the message editor.
Write a question about the current request or response, then send it to your configured model provider. Include the traffic context you need for that question.
Read the AI Chat guide →Start a conversation
Ask about the current HTTP request or response.
How do I test whether userId exposes another account’s data?
Follow the conversation to your next test.
Ask follow-up questions using recent conversation context. Use Clear chat to start afresh. Responses stay in the chat and do not create Burp issues.
Learn how to continue a conversation →You
How do I test whether userId exposes another account’s data?
BurpGPT · Ollama · gemma3
Sign in as test account A and request account B’s userId. Compare the response with B’s normal account response. If A can retrieve B’s details, capture the requests, responses, and account roles as evidence of cross-account access.
Your models. One Pro licence.
Bring AI analysis into your existing Burp workflow, with the freedom to choose where your model runs.
BurpGPT Pro
£99
£79 /year
Introductory price for early Pro customers.
- Keep model processing local through Ollama or on your own infrastructure.
- Connect Anthropic, Google AI Gemini, Mistral AI, OpenAI, or OpenAI-compatible APIs.
- Analyse selected HTTP requests and responses individually or in batches.
- Add AI scan checks to Burp's active scans.
- Ask follow-up questions in AI Chat with request and response context.
- Create, edit, import, and export reusable prompts.
- Bundled prompts for OWASP Top 10:2025 and API security reviews.
- Include request, response, and target details with traffic placeholders.
- Configure model names and supported generation parameters for your provider.
- Review insights alongside the original HTTP traffic in Burp issues.
- Inspect provider requests and responses in Burp Logger.
- Activate on up to 3 devices.
Requires a supported version of Burp Suite Professional. Model-provider accounts and usage costs are separate.
Buy BurpGPT ProLooking for the old Community edition? View the archived project. It is no longer maintained.
Questions, answered.
01 What do I need to get started?
BurpGPT Pro is an extension for Burp Suite Professional. You need a compatible Burp version, a Pro licence, and access to a local, self-hosted, or hosted model. See the installation requirements for the current supported versions.
Configure your provider in Provider settings for all three workflows. Before targeted analysis or active scanning, also configure your prompt in AI scanner. AI Chat uses your own conversation messages.
After purchasing, use the licence key from your purchase email to activate the extension. The quick-start guide takes you through installation, activation, provider setup, and your first analysis.
02 How many devices can I activate with one BurpGPT Pro licence?
One BurpGPT Pro licence includes up to 3 activations. Each successful Activate uses an activation, even on the same computer. Used activations cannot be recovered. Use Refresh to recheck an existing saved licence without using another activation.
Check your remaining allowance before activating again. See the licence activation guide for the full steps, or contact us with licensing questions.
03 Can I choose my own model provider?
Yes. Supported hosted providers include Anthropic, Google AI Gemini, Mistral AI, and OpenAI. You can also run local models through Ollama or connect a compatible self-hosted endpoint. Choose the provider and model to suit your engagement's data requirements and available infrastructure.
See supported model providers for setup options and compatibility details.
04 Can I keep model processing on my own infrastructure?
Yes. Use a local model through Ollama or a compatible self-hosted endpoint. BurpGPT Pro sends analysis prompts and the HTTP traffic they contain to the endpoint you choose in Provider settings. AI Chat sends your messages and the request/response context you select.
You control where the model runs. A local endpoint receives this analysis traffic on your machine; a remote self-hosted endpoint receives it on that server. If you choose a hosted model API, that provider receives the data under its own data-handling terms.
For local or self-hosted processing, check that your model runtime does not forward requests to a hosted service.
See data handling and chat context for details.
05 Does the BurpGPT Pro licence include model-provider costs?
No. BurpGPT Pro integrates with external model providers, but accounts, setup, quotas, and usage costs are managed separately with each provider.
Hosted providers may charge separately for API usage. Local or self-hosted providers may have their own infrastructure costs.
06 Can BurpGPT Pro produce false positives?
Yes. AI-generated insights can be incomplete, inaccurate, or overly confident, especially when the prompt or supporting traffic context is too broad.
BurpGPT Pro is designed to support security testing workflows, not replace manual validation. Treat generated insights as leads and validate them before including findings in a report.
07 How do I manage or cancel my subscription?
Use Manage Subscription in your purchase email to open the Stripe customer portal. Sign in with the email address used for your subscription to view billing information or cancel. See the subscription management guide for the full steps.
08 Why did my BurpGPT Pro activation fail?
Check your activation allowance, network access, system clock, and Burp version. A damaged extension download can also cause activation errors. Follow the troubleshooting guide for detailed checks.
For setup guides and troubleshooting, visit the documentation.