# knife: a Burp Suite context menu driven by configuration rows > knife is a Java Burp Suite extension that adds a right-click menu for updating cookies and headers, inserting payloads, dropping or forwarding requests, and running external commands. It ships as a jar, and every behaviour is a row in a configuration table. **bit4woo/knife** — A burp extension that add some useful function to Context Menu 添加一些右键菜单让burp用起来更顺畅 - Repository: https://github.com/bit4woo/knife - Website: https://www.bilibili.com/video/bv1BC4y1s7nS - Stars: 1,975 · Forks: 207 - Language: Java - License: MIT - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/bit4woo-knife ## The right-click menu is the product, and the configuration is the source knife is a Burp Suite extension, written in Java, whose stated purpose is to make small improvements to Burp so that daily use is smoother. The name comes from the idea of a small knife carving Burp a little, and the interface is exactly that: a set of additions to the context menu, plus one display tab, plus a rule engine. The important structural fact is that knife is configuration driven. Almost every feature is a named row in a table, and the menu item is a thin wrapper over that row. The `Action_` rows control what happens to a request automatically, the `Config_` rows hold the values that the features read, and the README shows the table with an index, a matcher, an action name and a boolean, for example: ```text 18 *.firefox.com Action_Drop_Request_If_Host_Matches true 19 *.mozilla.com Action_Drop_Request_If_Host_Matches true ``` Two warnings sit at the top of the documentation and are worth repeating, because they are the difference between a useful extension and a surprising one. The first is that the configuration must be changed to your own payload before use, especially for rows whose type starts with "Action". The second is that after installing a new version you have to follow the "Merge Config" section to update your configuration, which is a strong hint that rows are not migrated for you. The repository holds `src/`, a `pom.xml`, a `package.bat` for Windows packaging, an `assets/` folder with the screenshots, and both `README.md` and `README-en.md`, so the documentation exists in Chinese and English. The licence is MIT, and the project page is a video tutorial rather than a separate site. ## Three ways to get the jar: release, Maven, GitHub Actions Installing the extension is a jar operation, and there are three ways to obtain that jar. The first is the released one. Go to the repository releases page, download the latest jar, and load it into Burp Suite as an extension. The README shows the exact dialog for that, and it is the shortest path for anyone who only wants to use the extension. The second is building it locally, which needs a JDK and Maven. The commands are three lines: ```bash git clone https://github.com/bit4woo/knife cd knife mvn package ``` That produces the jar in the local `target` directory. Building yourself is the option to take when you want a change that has not been released, since the newest code lives on the default branch. The third route avoids a local toolchain entirely and goes through the project's GitHub Actions workflow. Open the Actions page, find the most recent successful build, which is the one marked green rather than the failed one marked red, and at the bottom of that run you will find the `jar-with-dependencies` artifact to download. That is the same jar with its dependencies bundled, so it is the one to take if you do not want to resolve dependencies yourself. The choice between the three is really a choice between release and unrelease. The released jar is the tested artifact, the Actions artifact is the tip of the branch, and the local build sits in between and lets you change things. ## Update Cookie walks the history backwards for the same host The cookie and header features exist to solve one problem: an old request in the repeater no longer works because the session it carries has expired, and the fresh session is somewhere else in the Burp history. Update Cookie does the lookup for you. The implementation described in the documentation is specific: it searches the Burp history in reverse, looking for a request whose host matches the current packet, and if that request carries a cookie, the cookie replaces the cookie in the current packet. Because the search runs backwards, the most recent matching request wins. The intended workflow is re-verifying an old vulnerability, where the cookie has to be current for the request to be meaningful. The caveat is in the documentation too, and it is a real one. If traffic from several accounts of the same system passes through the same Burp instance, the cookie that gets copied may belong to a different account than the one the request was made as. The README notes that knowing this turns the feature into a way to test for broken access control, because the copied credential is a different one. Update Header does the same job for sites that keep the user identifier in a header rather than in a cookie. The `tokenHeaders` configuration value holds the header names to look at, and the presets are `token`, `Authorization`, `Auth` and `jwt`, with the user free to add names of their own. Set Cookie is the third and the odd one out: it works on the response rather than the request. It adds a "set cookie" header to the current response so that later requests to the site carry those cookies. The use case is accessing a site by IP address, where the cookie scope rules mean the browser sends nothing useful, so you set the site's cookie explicitly. There are two ways: type the cookie value in directly, or give a domain and let the extension find the cookie in the history for that domain. ## Payload insertion substitutes %host and %DNSlogServer Two menu items insert a payload into the selected request, and they differ in how much they touch. Insert Payload puts a single configured payload into the current request. Two configuration values drive it. `Config_Custom_Payload` holds the payload as a string, and the payload may contain two variables, `%host` and `%DNSlogServer`, which are replaced with the corresponding values at insertion time. `Config_Custom_Payload_Base64` holds the payload in base64, for cases where the payload contains newlines or other special characters, or is binary, with the ImageMagic payload given as the example. Insert Payload For All is the batch version. The menu entry used to be called "Insert XSS" and was limited to inserting an XSS payload into multiple parameter values; it was strengthened so that any payload can be inserted now. The rule it applies is narrow on purpose: it inserts into all parameters of the current packet that are neither numeric nor cookies, and does the same thing across several parameters at once. That exclusion is what keeps the feature usable. Numeric parameters and cookie values are the two places where inserting an arbitrary string is almost always wrong, and the extension simply skips them rather than asking. The payload itself is yours to supply, which is what the configuration warning at the top of the documentation is about: the extension ships with example payload rows, and the documentation asks you to replace them before use. ## Run Cmd merged sqlmap and nmap into one template engine The command execution features were consolidated in version 2.3. Run SQLMap and Run Nmap both became part of Run Cmd, and the new menu item takes a command template from a configuration row of type `Run_External_Cmd`. The documentation is candid that the feature is not complete and invites feedback. The template supports a fixed list of fields that are substituted when the command runs: ```text BaseURL ---比如https://www.example.com FullURL ---比如https://www.example.com/user?id=1&isactive=true Host ---比如www.example.com HostPort ---比如www.example.com:443 Request RequestAsFile ---比如 将整个请求存入文件，并将文件名拼接到命令中，sqlmap命令中就有用到 RequestBody RequestHeaders Response ResponseAsFile ResponseBody ResponseHeaders ``` Each of these has a `Multi` variant, and the difference is about selection: when several HTTP packets are selected, the multi fields extract and process all of them, otherwise only the first one is processed. The sqlmap entry, for example, writes the whole request into a file and splices the file name into the command, which is what the `{request.txt}` placeholder in the documented command line does: ```bash python /usr/local/bin/sqlmap-dev/sqlmap.py -r {request.txt} --force-ssl --risk=3 --level=3 ``` The interesting part is how the command is launched. The `RunTerminalWithRobotInput` option controls it: ```text RunTerminalWithRobotInput Config_Basic_Variable false ``` When it is true, a command line terminal is opened and the command is entered by simulating keyboard input. The documentation describes the upside as an effect similar to human interaction, which leaves a history in the terminal, and the downside as instability, since the behaviour depends on the response speed of the program and on whether the clipboard read and write succeed. When it is false, all commands are written into a bat file which is then run, which is stable but leaves no history in the terminal. Running sqlmap, nmap or a custom command this way is, in the documentation's own words, executing system commands, and this is the sharpest edge in the extension. ## Drop and forward rules, and why the newest rule wins The Dismiss menu item and the rule engine underneath it are the parts of knife that change Burp's behaviour rather than adding a tool to it. The Dismiss group is about getting requests out of the way. `Action_Drop_Request_If_Host_Matches`, `Action_Drop_Request_If_URL_Matches` and `Action_Drop_Request_If_Keyword_Matches` discard any later request that matches, so it is never sent. The mirror set, `Action_Forward_Request_If_Host_Matches`, `Action_Forward_Request_If_URL_Matches` and `Action_Forward_Request_If_Keyword_Matches`, lets matching requests through without interception. The example rows drop anything under `*.firefox.com`, `*.mozilla.com`, `*.mozilla.org` and `*.mozilla.net`, which is the kind of noise a browser generates while a tester works. A dropped request still appears in the history, and the documentation points at Burp's own filter above the history, "Hide items without responses", to keep it out of sight. The third feature of the extension is the automatic modification of requests, and it is where the interesting rule lives. The scope of a rule is defined by ToolFlag and Scope: a request is modified when it comes from the proxy, the scanner, the repeater or the intruder, and it is also in scope. The order of application is stated explicitly, and it is unusual: the newer rule is used first, because it better represents the current intent of the person testing. So when two rules match the same request, the most recently added one wins, and the older row does not run at all. That design keeps quick experiments from being shadowed by standing configuration, at the cost of a configuration whose behaviour depends on row order rather than on specificity. A tester who adds a temporary rule and forgets to remove it will find that the standing rule no longer fires. ## The Chinese tab, and a released jar that lags the branch The one display feature knife adds is the Chinese tab, and it exists because Burp renders some Chinese traffic badly. It converts Unicode escape sequences into the characters they stand for, for example `\u4e2d\u6587` becoming `中文`, and the result depends on the encoding setting in Burp's own display options, so a wrong result can mean the encoding needs changing. The tab also handles the case where a packet contains Chinese characters that show up as garbage, by offering a choice of encodings. Syntax highlighting and automatic line wrapping were added on request to make long packets readable. The rest of the state of the project is worth recording. The repository is not archived and the last push was on 2026-10-08, but the released versions trail behind: v2.3 was published on 2024-05-06, v2.2 on 2023-04-25 and v2.1 on 2022-11-20. So the extension is being changed, while the jars most people download come from an older line. That gap has a practical consequence. The features described as new, such as Run Cmd and the merged sqlmap and nmap entries, belong to version 2.3, and anything committed to the branch after that release is not in a released jar at all. The build paths in the previous section exist for exactly this reason. The licence is MIT and the source is in `src/` with a Maven build in `pom.xml`. The documentation is bilingual, with `README.md` in Chinese and `README-en.md` in English, and `Help.md` in the root, so an English-speaking user has a real translation of the feature list rather than a partial one. ## Conclusion knife fits a tester who already works inside Burp Suite and wants the repetitive parts of a manual workflow turned into menu items: pulling a fresh cookie out of the history, marking a host into scope, dropping noise requests, or running a tool over the selected packet. It does not fit anyone who expects a released build to contain the newest behaviour, because the last release was v2.3 on 2024-05-06 while the last push was on 2026-10-08, and it does not fit a workflow that forbids running external commands from a testing proxy. Before installing it, read the warning about replacing the bundled payload configuration with your own, check the `RunTerminalWithRobotInput` setting so commands are not typed into a terminal window, and follow the "Merge Config" section the README asks for after every upgrade. ## FAQ ### How do I install the knife Burp Suite extension? Download the latest jar from the repository releases page and load it into Burp Suite as an extension. You can also build it yourself with `git clone https://github.com/bit4woo/knife`, `cd knife` and `mvn package`, or take the jar-with-dependencies artifact from the latest successful GitHub Actions build. ### What does the Update Cookie menu item do in knife? It searches the Burp history in reverse for a request with the same host, and if that request carries a cookie, the cookie replaces the one in the current packet. The documentation warns that when traffic from different accounts of the same system passes through the same Burp instance, the cookie copied may belong to another account. ### How do I run sqlmap on a request with knife? Run SQLMap was merged into Run Cmd in version 2.3, where the command template is configured and placeholders such as `{request.txt}` are replaced with the file holding the current packet. The `RunTerminalWithRobotInput` option decides whether the command is typed into a terminal window or written to a bat file and run. ### What do I have to do after upgrading the knife extension? The documentation tells you to follow the "Merge Config" section after installing a new version, which means the configuration rows are not migrated automatically. It also asks you to replace the bundled payload configuration with your own, especially for rows whose type starts with "Action". ## Sources - [bit4woo/knife on GitHub](https://github.com/bit4woo/knife) - [License: MIT](https://github.com/bit4woo/knife/blob/master/LICENSE) - [Project website](https://www.bilibili.com/video/bv1BC4y1s7nS) - [README](https://github.com/bit4woo/knife/blob/master/README.md) - [Releases](https://github.com/bit4woo/knife/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/bit4woo-knife