burp2model

Turn a Burp Suite history into an evidence-backed model of a web app.

Hosts, pages, scripts, endpoints, parameters, auth, and the gaps in what you captured, each tied to the request that proves it. Query it locally with no AI, or hand the model to your own AI instead of raw traffic.

Why

Pasting a multi-megabyte bundle and a HAR file into a chat model tends to produce invented endpoints and generic advice, and it ships your session cookies along with the bytes. burp2model builds a model first: every endpoint is tied to a real request, paths your code references but never calls are called out, and what the capture could not show is listed rather than guessed at. It is a model builder, not a scanner or exploit tool.

Install

pip install burp2model        # Python 3.9+, no dependencies

Quickstart

# In Burp: Proxy → HTTP history → select all → right-click → Save items → history.xml
# (a Logger++ CSV export works too)
burp2model history.xml --webapp shop

# Ask it questions, deterministically, with no language model involved
burp2model query shop "code vs runtime"
burp2model query shop list-apis
burp2model query shop help          # every question it answers

# No Burp? Crawl the running app instead (authorized targets only)
burp2model crawl https://shop.example.com/ -w shop --yes

Try it without a capture of your own: ./demo.sh builds the bundled sample.

Output goes to burp2model-out/shop/:

What you get

• A six-layer model: edge, routes, client code, APIs (each labelled BOTH, STATIC_ONLY or RUNTIME_ONLY), trust, and named unknowns. Every edge is OBSERVED or INFERRED, never mixed.
• Queries with no AI: every answer cites evidence ids and ends Model call: none. A question it cannot answer is refused, not guessed.
• Copy for AI: a rules-first context package your own model can reason over.
• Graph and BQL: a SQLite graph with a filter-and-path query language.
• Redaction first: secrets, cookies, tokens and PII are masked before anything is written. Secrets are kept only as a keyed fingerprint (kind, length, entropy).
• Deterministic: the same input gives byte-identical output.

Commands

Run burp2model <command> --help for options.

Boundaries

build also runs light external recon (DNS, TLS, headers) on the primary host. Turn it off with --no-osint or BURP2MODEL_OFFLINE=1. Only use crawl and osint on systems you are authorized to test.

CI plants fake secrets in the bundled samples and fails if any appears in any output.

Documentation

Full site: falc0n-researcher.github.io/burp2model

• How it works: the pipeline, layer by layer
• Exporting from Burp
• Crawling a running app, including scripted journeys
• Querying the model: query, BQL, graph, methodology
• Using it with AI
• Measurements: what Copy for AI saves, and when it doesn't
• Tested apps
• Skill: a no-install playbook that lets any capable AI run the method
• Changelog

License

Apache-2.0. See LICENSE.