Burp Suite Extension - To Monitor And Keep Track of Tested Endpoints

Burp Scope Monitor Extension

A Burp Suite Extension to monitor and keep track of tested endpoints.

Main Features

Simple, easy way to keep track of unique endpoints when testing an application

Mark individual endpoints as analyzed or not

Instantly understand when a new endpoint, not tested is requested

Accessible from Proxy tab (right click, mark request as analyzed/not)

Send to Repeater

Enforcement of Burp's in scope rules

Import/Export state file directly to a CSV file for

Autosave option


Make sure you have Jython configured under Extender -> Options -> Python Environment. For further instructions, check PortSwigger official instructions at their support page.git clone in Extender - Extender -> Extensions -> Add -> Select Python -> Select


Most of the options available in General or Import tabs are auto-explanatory.

"Repeater request automatically marks as analyzed" - when issuing a request to an endpoint from repeater, it marks this request as analyzed automatically."Color request in Proxy tab" - this essentially applies the behavior of the extension in the Proxy tab, if you combine these options with "Show only highlighted items" in Proxy. However, it's not as pleasant to the eyes as the color pallete is limited."Autosave periodically" - backups the state file every 10 minutes. When activating this option, consider disabling "Autostart Scope Monitor". This is in order to maintain a different state file per Burp project. However, you can easily maintain only one, master state file."Import/Export" is dedicated to handle the saved state files. It's preferred to open your Burp project file associated with the Scope Monitor. It will still work if the Burp project is different, but when loading the saved entries, you won't be able to send them to Repeater or view the request itself in the Request/Response viewer (this is due to the fact that we are not storing the actually requests - just the endpoint, it's analyzed status and a couple of other more. This makes it a little bit more efficient).

Future Development

Keep track of parameters observed in all requestsHighlight when a new parameter was used in an already observed/analyzed endpointExport to spreadsheet / Google SheetsAdding notes to the endpoint


The code is not yet performant, optimized or anything similar. KISS and it works. Performance will be increased depending on demand and how the extension performs when handling large Burp projects.

To circumvent some of Burp's Extender API limitations, some small hacks were implemented. One of those is automatically setting a comment on the requests that flow in the Proxy tab.

You can still add comments on the items, as you'd normally would, but just make sure to keep the placeholder string (scope-monitor-placeholder) there.

Hopefully in the future each requestResponse from Burp will have a unique identifier, which would make the import state / load from file much cleaner and fast. With large state files, this might hang a bit when loading.

For more depth analysis visit SOURCE : 1

An Ethical hacker should know the penalties of unauthorized hacking into a system. Read more at: Legality and Ethics

#hacker #cybersecurity #anonymous #ethicalhacker #ethicalhacking #malware #hacking #networkengineer #itsecurity #infosec #kalilinux #linux #ubuntu #programmer #vulnerability #bug #exploit #cissp #ceh #eccouncil #burpsuite #bugbounty #comptia #WAF #AWS #metasploit #nessus #acunetix #netsparker #nexpose


For more tricks and update over hacking stay tuned to our site: Note 4 Tech


Recent Posts

See All