Skip to Content
⚡ Alpha — full Android pipeline + iOS toolkit + live dynamic loop. API still shifting; pin to commits in CI.
IntegrationsBurp Suite

Burp Suite integration

MedusaNexus drives Burp via its REST API extension. Captured traffic feeds the Traffic tab and the API map’s live hits overlay.

Setup

  1. Install Burp Suite Pro (Community lacks the REST surface).

  2. Run scripts/setup.sh — the installer drops the REST API extension JAR into your Burp configuration directory.

  3. Open Burp → Extensions → Installed → confirm the extension is active.

  4. Open the extension UI → copy the API key.

  5. Add to ~/.mnexus/env.sh:

    export MNEXUS_PROXY_FLAVOR=burp
export MNEXUS_BURP_URL=http://localhost:1337
export MNEXUS_BURP_API_KEY=…           # from the extension UI

  6. Source the env file and verify:

    source ~/.mnexus/env.sh
mnexus doctor | grep burp
# burp  ● OK  v…  http://localhost:1337

How the orchestrator uses it

WhenWhat it does
Static scan completesCalls POST /scope to add the target package’s discovered hostnames to Burp’s scope.
/dynamic startConfigures the device proxy to point at Burp’s listener (set proxy.host / proxy.port in Burp).
/v1/projects/{id}/api-mapPulls GET /proxy/history filtered by scope to overlay live hits counts on the static URL tree.
/burp/probe-planRenders a plan of what Burp will replay against suspected endpoints (with mitigation per response code).
/burp/executeReplays the probe plan, materialises findings from responses.

Probe plan

🔱 nexus PRJ-… ❯ /serve
$ curl http://127.0.0.1:8765/v1/projects/PRJ-…/burp/probe-plan

Or open the Findings → Burp probes card in the SPA. The plan lists every suggested probe with:

  • The endpoint (host + path + method).
  • The reason MedusaNexus thinks it’s worth probing (static finding id
    • category).
  • The expected vulnerability if the probe returns 200.
  • The pre-written mitigation if it does.

Execute via:

POST /v1/projects/{id}/burp/execute

Each response that matches the vulnerability shape lands as a new finding with source_engine=burp.

Common pitfalls

⚠

API key rotates when you restart Burp. Recopy after each fresh Burp session and update ~/.mnexus/env.sh. The doctor will flag a 401 if the key is stale.

SymptomFix
burp ● MISS and the URL looks rightBurp is listening but the extension isn’t loaded. Check the extension UI.
401 from the doctorAPI key rotated. Recopy from the extension UI.
Traffic missing from /api-mapBurp’s scope doesn’t include the target. Confirm via Target → Scope.
The device never proxiesThe device’s WiFi proxy isn’t pointed at Burp. Set host = your Mac’s LAN IP, port = Burp listener port. Burp must listen on 0.0.0.0:8080, not 127.0.0.1.

Where to look in the code

  • Engine: mnexus/engines/burp_engine.py
  • REST client: same file
  • Probe planner: mnexus/intelligence/traffic_findings.py
IntegrationsCaido