> For the complete documentation index, see [llms.txt](https://gowsundar.gitbook.io/book-of-bugbounty-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowsundar.gitbook.io/book-of-bugbounty-tips/burp-suite.md).

# Burp suite

* [Interesting @Burp\_Suite extension (by @julianpentest) working with the collaborator to add from 200 to thousands payloads to find OS command injection. Even reading the readme is very instructive ! https://twitter.com/binitamshah/status/1011528746367504384](https://twitter.com/ddouhine/status/1012330355041370115)
* <https://github.com/portswigger/burp-smart-buster>
* [Burp Suite extensions I recommend (in no specific order): AutoRepeater, Content Type Converter, Param Miner, Request Minimizer, Backslash Powered Scanner, ActiveScan++, Taborator, Paramalyzer, Upload Scanner, Hackvertor, Piper, Request Timer, Logger++, Add Custom Header](https://twitter.com/Agarri_FR/status/1264296636785856514?s=20)
* [Do you have any problem with creating a new account in some application due to requirement of business email (corp)? Solution is here: #Burp Collaborator. Create an account with blabla@burpcollaborato.net and look after SMTP request at your client. #Security #bugbountytip #webap](https://twitter.com/zuh4n/status/1083472732778565633?s=20)[p](https://twitter.com/hashtag/webapp?src=hashtag_click)
* [Need a quick way to request 1000's of URLs in burp without crashing your browser?](https://twitter.com/jdksec/status/1262392592098082823?s=20)

  [cat yahoourls.txt| parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null](https://twitter.com/jdksec/status/1262392592098082823?s=20)