GatherBurp: a BurpSuite extension that bundles ten detection modules

One right-click menu for the checks a tester runs most

GatherBurp is a BurpSuite extension written in Java, and its organising idea is to replace a folder of separate plugins with one menu. Every feature is reachable the same way, either by right-clicking a request inside Proxy or Repeater, or through the GatherBurp tab in the top tab bar of BurpSuite.

The detection modules cover the vulnerability families that dominate Chinese-language web application testing. Fastjson scanning detects the deserialization flaw through DNS callbacks, JNDI chains, echo back based on Tomcat and Spring style environments, and version identification. Log4j detection works through DNS and IP callbacks across parameters and headers, with a custom payload list. SQL injection detection handles GET and POST parameters, cookies and multi-level JSON parameters, with error, time based and boolean based techniques and custom payload and rule support.

Beyond the classic injection trio there is an access control module that compares an original request, a low privilege request and a request with no permission at all, then analyses response length differences. URL redirect detection hunts common redirect parameters. All of these results can be sorted by numeric ID.

The target user is a penetration tester doing authorised work on their own or their client's systems. The README carries a disclaimer that the tool is for authorised security testing and education only, and that users bear the consequences of their use.

Detection leans on out of band callbacks, which is a real constraint

Understanding what the Fastjson and Log4j modules actually do matters, because their reliability depends on something outside the target application.

The Fastjson tab is configured with a DNS and an IP address, and the module offers distinct detection modes. A DNS check suits an environment with outbound access. A JNDI check supports both DNS and IP callbacks. An echo check is described as suited to internal networks. A version check identifies which Fastjson version is in use. Advanced configuration uses a dns type with a FUZZ placeholder for the scan.

The same callback structure applies to Log4j, which supports DNS and IP callback detection, parameter and header checks, and a customisable payload list. The README also documents a newer bypass technique in the authentication bypass module, where a 403 or 401 response triggers a resend using POST, TRACE, OPTIONS or HEAD, and separately a protocol downgrade that sends HTTP/1.1 as HTTP/1.0 in two variants.

The practical consequence is that a network without outbound DNS or IP reachability will produce false negatives, and an echo mode tuned to one application server will not transfer to another. The access control module has the same character, since it compares response length differences rather than proving a specific field was exposed. If your engagement rules prohibit any outbound callback, treat these modules as unverified.

The Route tab filters on an expression language rather than a status code

The route scanning module is the part of GatherBurp that departs from the usual find-a-200-and-report pattern. Instead of a single success signal, it evaluates a condition expression against each probed path.

The supported expression syntax looks like this:

code=200
body="hello"
title="druid"
headers="Content-Type: application/json"

And conditions can be combined:

code=200 && body="hello"
code!=200 && (body="hello" || title="druid")

The V1.3.0 changelog entry says the expression parser was rewritten to support &&, ||, parentheses and quotes, and that the default rule set was expanded to 34 rules. That is a meaningful upgrade for a false positive problem, since a rule set that can require a body string or a title match is far more selective than one that only checks the status code.

The changelog also documents a soft 404 safeguard added in V1.3.3. Before each probe the module requests a random path that should not exist, and if the target returns the same page for that path as it does for real hits, none of the results from that run are reported. A second fix in the same entry renames the Swagger Resources location keyword to api-docs and removes the weak Actuator keyword self, because the previous keywords were common enough in ordinary login pages to collide with soft 404 targets. A third change strips query parameters before combining probe paths, which stops probes such as ?gotourl=.../actuator from putting the payload into a parameter value.

FakeIP, the proxy pool and the tool launcher change what the target sees

Three helper features shape what the target observes, which is useful in testing situations where your source address or client identity is being filtered.

The FakeIP module, added in V1.3.1, fakes client IP request headers according to a chosen tool scope. It offers a multi-select of 26 common client IP headers including X-Forwarded-For, X-Real-IP and CF-Connecting-IP, and can populate them with a random domestic address, 127.0.0.1 or a custom value. The scope can be limited to Proxy, Repeater, Intruder or similar, and an Intruder random IP payload generator changes the IP on every request during a brute force run. The changelog notes this feature was integrated from an existing open source project, burpFakeIP.

The proxy pool supports SOCKS proxies and switches between several automatically. A Nuclei template generator produces scan templates for several vulnerability types, which is a hand-off point rather than a scanner.

The Nuclei template generator is worth reading as an alternative approach rather than a feature. A separate scanner driven by templates runs its own request flow and keeps its own state, while GatherBurp's own modules work from the request you are already looking at inside Burp. The generator is therefore a hand-off for coverage you do not want to reimplement, not a second engine inside the extension.

The tool launcher is the smallest but most flexible piece. You add a tool name and its command in the configuration tab, and three placeholders are available: the full URL of the current request, the hostname of the current request, and the temporary file path of the current request. A custom command is then available from the right-click menu, so an external scanner or script can be applied to the request in front of you without leaving the interface.

Compiling the JAR and loading it into BurpSuite Professional

The build is a plain Maven project. Requirements are JDK 1.8 or newer, BurpSuite Professional 2021.x or newer, and Maven 3.6 or newer for compilation only. The source sits in a src/ directory with a pom.xml at the top level.

Cloning and building takes three commands:

git clone https://github.com/kN6jq/gatherBurp.git
cd gatherBurp
mvn clean package

The resulting JAR file is written into the target/ directory. Loading it into Burp takes a short sequence: open BurpSuite Professional, go to the Extender tab and then the Extensions sub-tab, click Add, choose the Java type and select the compiled JAR, then click Next to finish loading.

Once loaded, the entry points are the two already mentioned, the right-click menu on requests in modules such as Proxy and Repeater, and the GatherBurp tab. Individual checks then follow a consistent shape. The Fastjson scan is configured on the configuration tab with DNS and IP values, then invoked from the right-click menu by choosing FastJson and a detection type. The SQL Inject, Log4j Scan, Perm Check and UrlRedirect entries work the same way, opening a tab where you configure parameters and then read the results with the full request and response.

The permission check is worth calling out because it needs two extra credentials. On the Perm Check tab you supply authentication information for a low privilege account and for an account with no permission, and the module then compares the three responses.

Version history shows a 1.3 line built on rewritten internals

The recent release list shows V1.1.2 in July 2024, V1.2.0 in November 2024 and V1.3.0 on 2026-09-22. The last push was on 2026-10-09, and the changelog records a V1.3.3 entry dated 2026-10-08, so the newest documented build is ahead of the newest tag.

The 1.3.0 entry is the most substantial. It rewrote the RouteScan expression parser, reviewed and fixed more than ten modules including Fastjson, Log4j, SQL injection, access control detection, authentication bypass, the SOCKS proxy pool, the Similar module and the settings, added cross-project data isolation and DNS resolution timeout protection to the Similar module, capped table and cache memory, and made the interface fully bilingual between Chinese and English.

The Similar module is the passive collection piece. You create a project and configure a list of main domains, then proxy traffic is collected automatically: related subdomains and URLs are gathered passively, deduplicated, resolved to IP addresses with a timeout that skips unresponsive hosts, and stored locally in SQLite. The results table supports copying in one action.

On licensing, the README links an MIT License file, while the repository license field is not identified, so confirm the terms in the LICENSE file before redistributing the extension. The project also carries a public roadmap of more detection modules, performance and refactoring work, better documentation and examples, and more custom configuration options, with internationalisation marked done.

Editorial conclusion

GatherBurp suits a penetration tester who already has BurpSuite Professional and wants one extension to cover Fastjson, Log4j, SQL injection, access control and route discovery without assembling a separate plugin set. It does not suit a team without a commercial Burp licence, and it does not suit anyone who needs reproducible scan results, since the detection logic leans on DNS or IP callbacks and response length comparison rather than on deterministic proof. Before you rely on it, check the V1.3.3 changelog entry against your saved rule set, since old expressions are auto-migrated on load, and confirm the JDK 1.8 and BurpSuite Professional 2021.x requirements against the machine that will run the scans.

Frequently asked questions

Official sources

1. Issues
2. kN6jq/gatherBurp on GitHub
3. README
4. Releases