Burp extension development

Establish the extension contract

Determine the supported Burp editions and minimum version, entry points, user-visible actions, data lifetime, and required artifact. Distinguish a loadable extension JAR from a BApp submission. A request to build an extension does not imply installing it into a running session or sending requests.

Check the installed Burp/JVM and build tools at runtime when available. Keep machine paths, captured traffic, credentials, and workstation details out of this skill and distributable examples. Use synthetic fixtures.

Choose and verify the API

Prefer Java with the maintained Montoya API for new extensions. Use the legacy Extender API only for an existing integration or a concrete compatibility requirement. Python extensions using that API require a compatible standalone Jython runtime; system Python is not a substitute.

Read the official documentation and verify exact signatures against the pinned API artifact. Do not assume the API artifact has the same version number as Burp. Select a Java compilation target supported by the intended Burp runtime. Keep the Montoya dependency compile-only/provided; Burp supplies it at runtime.

For Community compatibility, identify edition-dependent services before implementation. Context menus, Swing UI, and ordinary HTTP message access need no Scanner dependency. Do not infer Community support for Scanner, Collaborator, or AI features from an interface merely being present.

Useful primary sources: