Some of the useful extensions from the BApp Store are as follows:
• Active Scan++ – This extension is developed to further enhance the Burp Suite’s passive and active scanning capabilities.
• Additional Scanner Checks – This extension adds a few more checks to a passive scanner like DOM-based XSS etc.
• CSRF Scanner – This extension helps passively scan for Cross-Site Request Forgery (CSRF) vulnerabilities.
• Discover Reverse Tabnabbing – This extension searches the HTML code for possible Tabnabbing vulnerabilities.
• Error Message Checks – This extension helps passively detect any error or exception messages that may contain sensitive information like stack traces.
• Headers Analyzer – This extension passively checks the response headers and flags all missing security headers like X-XSS-Protection, X-Frame-Options, and many more.
• HTML5 Auditor – This extension checks if any of the potentially unsafe HTML5 functions have been used like storing sensitive data on client-side storage, client geolocation, etc.
• J2EEScan – This extension helps improve test coverage for J2EE applications as well as adds additional test cases.
• Java Deserialization Scanner – This extension adds to the Burp Suite ability to detect Java Deserialization vulnerabilities.
• JavaScript Security – This extension further adds several passive checks related to JavaScript security like DOM issues, Cross-Origin Resource Sharing (CORS), etc.
• Retire.js – This extension passively monitors the traffic and detects the use of any vulnerable third-party library along with necessary CVE details.
• SameSite Reporter – This extension checks if the SameSite attribute has been set in cookies or not.
• Software Version Reporter – This extension passively parses the traffic and reports all the software version details. This information can further help in application enumeration.
• Upload Scanner – This extension adds capabilities to Burp Suite to detect file upload functionality and related vulnerabilities.
• Web Cache Deception Scanner – This extension scans the application for the presence of any Web Cache Deception vulnerability.
• CSP Auditor – This extension scans the response headers and checks if Content Security Policy (CSP) has been configured correctly or not.
• CVSS Calculator – This extension facilitates scoring vulnerabilities using CVSS methodology from within Burp Suite.
Manual install to Burp Suite:
• sometime – This extension can be downloaded from https://github.com/linkedin/sometime. This extension passively monitors the traffic to check if the application is vulnerable to the Same Origin Method Execution.
• burp-suite-gwt-scan – This extension can be downloaded from https://github.com/augustd/ burp-suite-gwt-scan - This extension helps automatically identify insertion points for GWT (Google Web Toolkit) requests when sending them to the active Scanner or Burp Intruder.
• Admin panel finder – This extension can be downloaded from https://github.com/moeinfatehi/ Admin-Panel_Finder -This extension assists in the enumeration of infrastructure and application Admin Interfaces that might have been left open by mistake.
• Pwnback – This extension can be downloaded from https://github.com/P3GLEG/PwnBack. This extension helps to retrieve old and archived versions of the application if present. It can be useful to compare the old and current versions of the application to check the changes and associated vulnerabilities.
• Minesweeper – This extension can be downloaded from https://github.com/codingo/Minesweeper -This extension helps detect scripts being loaded from over 23000+ malicious cryptocurrency mining domains (cryptojacking).
For an additional and comprehensive list of the Burp Suite extensions, refer to https://github.com/snoopysecurity/awesome-burp-extensions.