gitmyhub

go-burp-rest

Go ★ 7 updated 8y ago ▣ archived

Golang API client for @vmware's burp-rest-api

A Go library for programmatically controlling Burp Suite, a popular web app security testing tool, through its REST API so you can automate security scans from Go code.

GoBurp Suite REST APIsetup: moderatecomplexity 2/5

go-burp-rest is a Go library that lets programs talk to Burp Suite programmatically. Burp Suite is a popular security testing tool used to find vulnerabilities in web applications, and the burp-rest-api extension (built by VMware) exposes Burp's features through a web interface. This library gives Go developers a clean way to interact with that interface without writing raw HTTP requests themselves.

The author created it as an alternative to the code automatically generated by swagger-codegen, a tool that builds API clients from specification files. They found that generated code unwieldy and wrote this library by hand instead. The code sets up a client pointed at wherever your Burp API is running, then provides methods to call various Burp functions. For example, you can ask it for the running Burp version, and it returns that information in a structured Go format ready to use in your code.

This would appeal to security engineers or developers building automated security testing pipelines. If you're running Burp scans as part of your development process and writing your automation tooling in Go, this library saves you from manually constructing HTTP requests and parsing responses. The sample usage shows checking the Burp version, but the broader use case is orchestrating scans and pulling results programmatically.

The README is upfront about limitations: the author calls out some "hacky bits" in the helper code and notes that testing is incomplete. Several improvements are planned, including configuration endpoints and a command-line tool, but these aren't implemented yet. The author also points to a companion project for running the Burp API in Docker, which would be useful for setting up the server side this client connects to.

Where it fits