Burp Suite extension for passive GraphQL reconnaissance. Catalogs operations from proxy traffic, tracks variable shapes with sample values, stores original requests per signature, and sends to Intruder with auto-marked payload positions. Supports status triage, export/import for session persistence, and batched mutation detection.
graphql proxy penetration-testing bug-bounty web-security appsec offensive-security jython intruder security-tools reconnaissance security-testing graphql-security api-security attack-surface burp-suite burp-extension burp-suite-extension graphql-fuzzing graphql-operations
-
Updated
Mar 16, 2026 - Java