SQL querying and AI-assisted analysis over your Burp Suite proxy traffic, powered by DuckDB.
Burp's proxy history is great for individual request inspection, but terrible for answering questions like "which endpoints returned 200 to unauthenticated requests?" or "where are numeric IDs in paths that could be IDORs?". DuckDuckBurp solves this by capturing every proxied response into a local DuckDB database and giving you a full SQL interface — plus an AI analyst — directly inside Burp.
-- Find paths that returned 200 without auth tokens
SELECT DISTINCT host, path, status_code
FROM traffic
WHERE status_code = 200
AND lower(req_headers::VARCHAR) NOT LIKE '%authorization%'
AND regexp_extract(lower(path), 'admin|api|internal|private') <> ''
ORDER BY host, pathTraffic capture is DuckDuckBurp's data source, not its primary workflow. Logger++ is a logging, filtering, highlighting, tagging, and grep workflow. ElasticBurp sends traffic to an external Elasticsearch index for extended search. DuckDuckBurp is an embedded analytical workbench for relational, cross-request security investigations.
| Capability | DuckDuckBurp | Logger++ | ElasticBurp |
|---|---|---|---|
| Primary workflow | Cross-request security analysis | Log inspection and filtering | External indexing and search |
| Analysis model | Full DuckDB SQL: aggregates, joins, window functions, regex, and JSON | UI filters and regular expressions | Elasticsearch queries and aggregations |
| Security workflows | 50+ OWASP Top 10, CWE, recon, authentication, and input-surface queries | User-defined filters and grep | General search over indexed traffic |
| AI | Burp AI converts a plain-English hypothesis into SQL that is loaded for review and never run automatically | No equivalent published workflow | No equivalent published workflow |
| Deployment | Bundled embedded database; no external service | Runs in Burp, with CSV export and optional Elasticsearch upload | Requires a separate Elasticsearch service |
A representative workflow is to normalize identifiers across thousands of paths, group the variants, compare response outcomes, and inspect the matching exchanges. That is relational analysis across an engagement, not simply finding individual log entries that match a pattern.
- Write any DuckDB SQL against your live traffic — full
SELECT,WHERE,GROUP BY, window functions, regex, JSON access, everything - 50+ canned queries covering Recon, Authentication, Input Surface, Errors & Leakage, OWASP Top 10, CWE Web, and Security — click any to load it for review
- Click a result row to inspect the stored request/response headers and bodies
- Save your own queries to a shared library that persists across all Burp projects
- Export results to CSV, JSON, or Parquet via DuckDB's
COPYcommand - Keyboard shortcut: Ctrl+Enter to run
- Live traffic stats: total requests, unique hosts, method breakdown, top status codes, auth failure count, server error count
- Auto-refreshes as traffic flows in
- Ask plain-English questions about your traffic; the AI generates a summary and suggests targeted SQL queries
- Works with Burp AI (uses your Burp AI credits) or any OpenAI-compatible endpoint — OpenAI, Ollama, LM Studio, Azure OpenAI, etc.
- Suggested read-only SQL can be loaded into the Query tab for review or saved; model output is never executed automatically
- AI response renders as formatted markdown (toggle to raw text at any time)
- Optionally includes a compact traffic summary in the prompt for context-aware answers
- Local capture — proxied request/response data is stored in DuckDB files on your machine, outside the Burp project file
- Per-project isolation — each Burp project file gets its own traffic database; switching projects shows only that engagement's traffic
- Shared query library — saved queries persist across all projects in a separate shared database
- Explicit AI disclosure — no traffic context is sent unless you initiate an analysis and opt in to Include in-scope traffic summary. That context contains only aggregate counts, top in-scope hosts, distributions, and recent methods/redacted paths/statuses; query strings, headers, and bodies are excluded
- Burp AI is the default provider. Optional third-party calls use Burp networking with upstream TLS verification and still require Burp's Use AI permission
- Burp Suite Professional 2026.4 or later
- Java 21 — bundled with modern Burp Suite, no separate install needed
- In Burp: Extensions → BApp Store
- Search for DuckDuckBurp
- Click Install — all dependencies are bundled, no additional setup required
- Download
DuckDuckBurp.jarfrom the Releases page - In Burp: Extensions → Installed → Add
- Select the downloaded JAR and click Next
- The DuckDuckBurp tab appears in the main Burp window
git clone https://github.com/rainmana/DuckDuckBurp.git
cd DuckDuckBurp
./gradlew jar
# Output: build/libs/DuckDuckBurp.jarRequires Java 21+. All other dependencies are fetched automatically by Gradle.
- Load the extension and browse your target normally through Burp's proxy
- Open the DuckDuckBurp tab — the Dashboard shows live stats as traffic flows in
- Click the Query tab and pick a canned query from the sidebar, or write your own
- Click a result row to view the full request/response in the detail pane below
- Open the AI Analyst tab, configure your AI backend in Settings, and ask a question
| Data | Location |
|---|---|
| Traffic (per project) | ~/.burp/duckduckburp/<projectId>.db |
| Saved queries (all projects) | ~/.burp/duckduckburp/shared.db |
A unique 12-character project ID is generated on first load per Burp project file and stored in Burp's project-scoped extension data. The full path to the active traffic database is logged to the extension output panel on startup.
These databases can contain credentials, tokens, and other sensitive traffic in plaintext. Protect the host account and delete engagement databases when they are no longer needed.
You can query the database directly with the DuckDB CLI outside of Burp if needed.
The editor accepts any valid DuckDB SQL. Press Ctrl+Enter or click Run Query to execute. Results appear in the table below; click any row to load the stored headers and bodies in the detail pane.
The table displays at most 10,000 rows to keep Burp responsive. Export… executes the query directly through DuckDB and is not subject to the display cap.
If your query doesn't include the id column, the detail pane shows a hint asking you to add it.
The left sidebar groups 50+ built-in queries by category. Click a query name to load it into the editor, then choose Run Query. These queries live in code and are always available regardless of which project you have open.
- Write your query in the editor
- Click Save Query…
- Enter a name and choose or type a category
- The query is saved to
shared.dband appears in the ★ Saved Queries section of the sidebar in every project
Right-click a saved query in the sidebar to delete it. Use Import… and Export… to share query libraries as JSON files.
Click Export…, choose CSV / JSON / Parquet, and pick a save location. DuckDB writes the file directly — no row-count limits.
CREATE TABLE traffic (
id BIGINT PRIMARY KEY, -- Burp's internal message ID
timestamp TIMESTAMPTZ, -- time the response was captured
host VARCHAR, -- e.g. "example.com"
port INTEGER,
protocol VARCHAR, -- "http" or "https"
method VARCHAR, -- "GET", "POST", etc.
path VARCHAR, -- full path including query string
status_code INTEGER,
req_headers JSON, -- request headers as JSON object
req_body VARCHAR, -- captured request body (up to 5 MB)
req_body_truncated BOOLEAN,
resp_headers JSON, -- response headers as JSON object
resp_body VARCHAR, -- captured response body (up to 5 MB)
resp_length INTEGER, -- original response body byte length
resp_body_truncated BOOLEAN,
in_scope BOOLEAN -- scope state when captured
)-- IDOR candidates: paths with numeric IDs, multiple variations seen
SELECT host, method,
regexp_replace(path, '[0-9]+', '{id}') AS path_pattern,
COUNT(DISTINCT path) AS id_variations
FROM traffic
WHERE regexp_extract(path, '/[0-9]+') <> ''
GROUP BY host, method, path_pattern
ORDER BY id_variations DESC
LIMIT 20;
-- Unauthenticated access to privileged-looking endpoints
SELECT id, host, method, path, status_code
FROM traffic
WHERE status_code = 200
AND lower(req_headers::VARCHAR) NOT LIKE '%authorization%'
AND regexp_extract(lower(path),
'admin|manager|internal|private|restricted|staff') <> ''
ORDER BY host, path;
-- POST/PUT/DELETE requests missing CSRF headers
SELECT id, host, method, path, status_code
FROM traffic
WHERE method IN ('POST', 'PUT', 'DELETE', 'PATCH')
AND lower(req_headers::VARCHAR) NOT LIKE '%csrf%'
AND lower(req_headers::VARCHAR) NOT LIKE '%xsrf%'
ORDER BY id DESC
LIMIT 50;Go to the Settings tab and choose an AI backend:
Burp AI — the default provider; uses your Burp AI credit balance. Enable AI globally and select Use AI for DuckDuckBurp under Extensions → Installed.
Custom endpoint — any OpenAI-compatible API:
| Field | Example |
|---|---|
| URL | https://api.openai.com/v1 or https://api.openai.com/v1/chat/completions |
| API key | sk-… |
| Model | gpt-4o-mini |
Compatible with OpenAI, LiteLLM (http://127.0.0.1:4000/v1), Ollama (http://localhost:11434/v1), LM Studio, Azure OpenAI, and similar services. DuckDuckBurp accepts either the API base URL or a full OpenAI-compatible text endpoint, and it can automatically use chat/completions, responses, or legacy completions for text-capable LiteLLM models.
Remote custom providers must use HTTPS. Plain HTTP is accepted only for loopback endpoints such as local Ollama, LiteLLM, or LM Studio instances.
For LiteLLM specifically, use a text-generation model alias in the Model field. Embedding, image, audio, moderation, realtime, and other non-text models are not valid for the AI Analyst tab.
Type your question in the text area and press Ctrl+Enter or Ask AI. Traffic context is off by default. Select Include in-scope traffic summary to send compact, structured metadata for in-scope traffic. Query strings, headers, and bodies are never included; numeric IDs, UUIDs, and long token-like path segments are replaced with placeholders.
Example prompts:
- "Summarize the attack surface and highlight anything worth investigating"
- "Are there any endpoints that look vulnerable to IDOR?"
- "What authentication mechanisms are in use and where might they be bypassable?"
- "Generate a query to find all JSON endpoints that accept user-supplied IDs"
After each response, any SQL code blocks the AI produced appear in the Suggested Queries panel:
- Review — switches to the Query tab and loads the SQL without executing it
- 💾 Save — opens the save dialog with an auto-suggested category based on the query content
AI output is untrusted. Review every suggestion before choosing Run Query.
| Category | What it finds |
|---|---|
| Recon | All hosts and request counts, full URL inventory, HTTP methods in use, status code breakdown, traffic timeline by minute |
| Authentication | All 401/403 responses, paths with mixed auth results (bypass candidates), login/auth/SSO endpoints, requests with Bearer tokens or API keys |
| Input Surface | Non-GET endpoints, endpoints with query parameters, requests with bodies, JSON content-type requests |
| Errors & Leakage | All 5xx server errors, all 4xx client errors, largest responses, 404 patterns, large error response bodies |
| OWASP Top 10 | A01 mixed-auth paths, A01 privileged paths returning 200, A02 sensitive data over HTTP, A03 injection patterns, A05 debug/config endpoints, A07 auth failure hotspots, A10 SSRF indicators |
| CWE Web | CWE-79 XSS script patterns, CWE-89 SQL injection payloads, CWE-22 path traversal sequences, CWE-352 state-changing requests without CSRF tokens, CWE-601 open redirect parameters, CWE-918 SSRF URL parameters |
| Security | Interesting paths (admin/debug/backup/config/…), numeric ID patterns for IDOR analysis, API versioned endpoints, 3xx redirect chains, potential file upload endpoints |
- Added an explicit comparison with Logger++ and ElasticBurp to clarify DuckDuckBurp's analytical workflow
- Fixed per-project isolation by storing the database identifier in Burp project data instead of global preferences
- Limited optional AI context to structured, in-scope metadata with query strings, headers, and bodies excluded; context is now off by default
- Routed optional third-party AI calls through Montoya networking with upstream TLS verification and the Use AI permission gate
- Escaped model output, blocked remote Markdown resources, and changed suggested SQL to review-only loading
- Added owned, bounded background executors and clean unload handling
- Updated Montoya API, DuckDB JDBC, and Jackson dependencies; added versioned JAR metadata and CI
- Removed the unreleased Agent Access beta pending a separately isolated design
- Improved LiteLLM Proxy compatibility for local, Docker, and CLI-backed setups
- Accepts either a base URL like
http://127.0.0.1:4000/v1or a full endpoint URL - Automatically supports OpenAI-compatible text endpoints across
chat/completions,responses, and legacycompletions - Added regression tests covering endpoint selection, fallback behavior, and response parsing
- Initial public release of DuckDuckBurp
- DuckDB-backed traffic capture, query UI, saved queries, dashboard, and AI Analyst tab
For the full release history, see GitHub Releases.