Burp Suite自动化测试咨询：能否用脚本实现请求联动测试？

Absolutely, you can automate your testing workflows in Burp Suite—let’s break down your questions one by one to get you sorted:

You have several solid options to ditch manual request sending:

• Burp Macros: Record a sequence of dependent requests (like logging in first, then accessing a protected endpoint) and reuse them across Repeater, Intruder, or Scanner. Head to Project options > Sessions > Macros to create/edit macros—you can even set up rules to extract dynamic values (session IDs, CSRF tokens) from responses and auto-populate them into subsequent requests.
• Burp Intruder: While primarily for fuzzing, it’s perfect for automating batches of requests. If your test cases involve repeating similar requests with varying parameters, Intruder’s payload sets and resource pooling will handle the heavy lifting.
• Custom Extensions: For complex, tailored automation (like conditional request triggering or custom response parsing), the Burp Extender API lets you build tools that fit your exact needs—this is the most flexible approach.

Repeater doesn’t have a built-in JavaScript runtime, but you can still implement the "send first request → parse response → send dependent request" flow with these workarounds:

• JavaScript Extensions: Burp’s Extender module supports JavaScript (via modern JS engines in recent builds). You can write a simple JS extension that listens for responses from your first request, extracts required data (e.g., a JSON web token), constructs the second request dynamically, and sends it through Burp’s API.
• Burp Macros (No Code Needed): If you don’t want to write scripts, macros can handle this logic out of the box. When editing a macro, add an action to Extract data from response (using regex, XPath, or plain text matching) and map the extracted value to a parameter in your next request.
• Third-Party Extensions: Tools like Burp Script let you inject JavaScript snippets to manipulate requests and responses, giving you script-level control without building a full extension.

Burp Suite Extender API supports multiple languages beyond its native Java:

• Python: Use Jython (a Java-based Python interpreter) to write Python extensions—this is one of the most popular choices for Burp scripting, with tons of community-made tools (like Turbo Intruder and Autorize) using this approach.
• Ruby: JRuby (Java-based Ruby interpreter) lets you write Ruby extensions, ideal for quick, scripted automation tasks.
• JavaScript: As mentioned earlier, modern Burp versions support JS extensions directly, so you can leverage your JS skills to build custom tools.
• JVM Languages: Any language that compiles to Java bytecode (Kotlin, Scala, Groovy) works natively with Burp, since it’s a Java application.

内容的提问来源于stack exchange，提问作者Сергей