Burp AI is an on-demand assistant inside Repeater that helps you analyze, understand, and test HTTP messages efficiently. It acts as a skilled penetration tester, automating mundane tasks while you stay in control of your workflow.
You can use it to:
Burp AI is designed to augment, not replace, your expertise. It frees up time and resources so you can focus on complex reasoning, creative attack techniques, and impactful results.
While testing an e-commerce application, you notice a response that exposes several user IDs. You suspect these identifiers could be used to access other users' data.
Instead of manually testing each possibility, you ask Burp AI to investigate. It identifies the parameter controlling object access, constructs a series of requests substituting the leaked IDs, and confirms that some return data belonging to other users.
Burp AI then checks related endpoints for similar behavior and summarizes the confirmed insecure direct object reference (IDOR) for reporting.
To run a Burp AI task in Repeater:
Burp displays a notification when the task starts. Click View task to open the task in the Tasks panel. Completed tasks are saved to your project file.
You can run a Burp AI task on any Repeater tab that has a specified target. For more information on configuring targets, see Working with HTTP messages in Burp Repeater.
Burp AI doesn't retain conversation history. Include all necessary context in each prompt.
You can choose which information Burp AI uses as context when you run a task. Including the relevant context improves both response quality and credit efficiency.
By default, Burp AI includes the full request and response as context.
If you highlight part of a request or response, such as a parameter or header, you can use the lozenges in the prompt dialog to add it as specific context. This focuses Burp AI's analysis on that section.
You can include any notes you added to the current Repeater tab by clicking + and selecting Notes. Burp adds the entire contents of the Notes panel as context.
For more information on adding notes in Repeater, see Adding notes for HTTP Repeater tabs.
To remove a context item, click the x button on its lozenge in the prompt dialog.
To add the item again, click + and select the item from the menu.
To view an AI task:
Each AI task contains two tabs:
The Task progress tab shows the actions Burp AI performs during a task as a series of steps. You can review every step and reproduce any action manually if needed.
Some steps have additional options available, depending on the tool Burp AI used at that point.
For Repeater steps, you can:
For Intruder steps, you can:
The Logger tab shows a complete record of all HTTP requests and responses generated during the task.
To end a Burp AI task manually, select it and click Finish task. Tasks also end automatically if Burp AI determines it can't progress further.
Burp AI in Repeater is designed to be transparent, reproducible, and always under your control.
For more details on AI security and data handling across all of Burp AI's features, see AI security, privacy and data handling.