AI-Powered Passive Vulnerability Analysis for Burp Suite
Intelligent • Silent • Adaptive • Comprehensive
🚀 Getting Started • 📖 Documentation • 🔧 Configuration • 📊 Benchmarks • ⬆️ Upgrade to Pro
Note: This is the Community Edition. Commercial and Professional Editions with advanced features are available separately.
SILENTCHAIN AI™ - Community Edition is a Burp Suite extension that brings the power of artificial intelligence to web application security testing. Using advanced AI models, SILENTCHAIN performs intelligent passive analysis of HTTP traffic to identify OWASP Top 10 vulnerabilities, security misconfigurations, and potential attack vectors.
Traditional security scanners rely on predefined signatures and patterns. SILENTCHAIN AI™ goes beyond with:
- 🧠 AI-Powered Analysis: Leverages state-of-the-art language models (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure) for intelligent vulnerability detection
- 🎯 Context-Aware Detection: Understands application logic and business context, not just pattern matching
- ⚡ Real-Time Scanning: Analyzes traffic as it flows through Burp's proxy
- 📊 Professional Reporting: Generates detailed findings with CWE, OWASP mappings, and remediation guidance
- 🔄 Zero False Positives: AI validation reduces noise and focuses on real vulnerabilities
- 🆓 Community Edition: Free passive analysis capabilities
- Real-time traffic analysis through Burp Proxy
- OWASP Top 10 vulnerability detection
- CWE-mapped security findings
- Intelligent confidence scoring
- Modern, intuitive dashboard
- Live findings panel with severity color-coding
- Task tracking and management
- Integrated console logging
- Burp AI (default; in-process, zero-config; Burp Suite Professional)
- Ollama (local, free, privacy-focused)
- OpenAI (GPT-4 / GPT-4o)
- Claude (Anthropic)
- Gemini (Google)
- Azure OpenAI / Foundry
- Detailed vulnerability descriptions
- Affected parameters identification
- CWE and OWASP mappings
- Remediation recommendations
- Direct links to security resources
- Enabled by default — automatically protects sensitive data before it leaves your machine
- Bidirectional redaction: sensitive values are replaced with
[REDACTED_*]placeholders before sending to cloud AI providers, then restored in the response - Detects and redacts:
- API keys — OpenAI (
sk-), GitHub (ghp_), AWS (AKIA), GitLab (glpat-), Slack (xoxb-) - Authorization headers — Bearer tokens, Basic auth
- Credentials — password/secret/token fields,
user:pass@hostURIs - Session cookies — session IDs, CSRF tokens, JWTs, auth tokens
- Email addresses
- IP addresses & hostnames — target infrastructure details
- API keys — OpenAI (
- Skipped entirely for Ollama (local-only, no data leaves your machine)
- Can be toggled off in Settings for advanced users
SILENTCHAIN AI™ detects a wide range of security issues including:
| Category | Vulnerabilities |
|---|---|
| Injection | SQL Injection, NoSQL Injection, Command Injection, LDAP Injection, XPath Injection |
| Cross-Site Scripting | Reflected XSS, Stored XSS, DOM-based XSS |
| Authentication | Broken Authentication, Session Management Issues, Credential Exposure |
| Access Control | IDOR, Broken Authorization, Privilege Escalation |
| Cryptography | Weak Encryption, Insecure SSL/TLS, Sensitive Data Exposure |
| Configuration | Security Misconfigurations, Default Credentials, Debug Enabled |
| XXE | XML External Entity Attacks |
| Deserialization | Insecure Deserialization |
| Components | Vulnerable Dependencies, Outdated Libraries |
- Burp Suite Professional 2025.2+ (recommended — required for the default Burp AI provider) or Burp Suite Community (works with external providers such as Ollama)
- Java 21 runtime (bundled with current Burp releases)
- An AI provider (one of the following):
- Burp AI (default; zero-config; requires Burp Suite Professional + an active Burp AI subscription)
- Ollama (free, local, privacy-focused)
- OpenAI API key
- Claude (Anthropic) API key
- Gemini (Google) API key
- Azure OpenAI / Foundry
-
Download the extension
- Grab the latest
silentchain-community-edition.jarfrom GitHub Releases (this link always serves the newest build). Specific versions (silentchain-community-edition-X.Y.Z.jar) are on the Releases page.
- Grab the latest
-
Load it in Burp Suite
- Go to Extensions → Installed → Add
- Set Extension type: Java
- Select the downloaded
.jarand click Next
-
Configure your AI provider
- Open the SILENTCHAIN Community tab → ⚙ Settings
- Pick a provider — Burp AI works with no configuration. For an external provider, set the API URL / key / model, click Test Connection, then Save.
-
Start scanning
- Set your target scope in Burp (Target → Scope)
- Enable passive analysis in the SILENTCHAIN Community tab (it is OFF by default), then browse the target through Burp's proxy — or right-click any request → Analyze (SILENTCHAIN) for on-demand analysis
- Findings appear in the SILENTCHAIN Community tab and as native Burp Scanner issues
- Cross-platform: Windows, macOS, Linux
- Burp Suite Community or Professional (Professional + AI subscription for the Burp AI provider)
- Java 21 (bundled with current Burp releases)
Requires Burp Suite Professional + an active Burp AI subscription. No API URL or key needed — analysis runs in-process through PortSwigger's Burp AI service and consumes Burp AI Credits from your account.
- Provider:
Burp AI - API URL / Key / Model: (not required)
Free, local, no API keys required
-
Install Ollama:
# macOS/Linux curl -fsSL https://ollama.ai/install.sh | sh # Windows # Download from https://ollama.ai/download
-
Pull a model:
ollama pull deepseek-r1 # or ollama pull llama3 -
Configure SILENTCHAIN:
- Provider:
Ollama - API URL:
http://localhost:11434 - Model:
deepseek-r1:latest
- Provider:
-
Get API key from platform.openai.com
-
Configure SILENTCHAIN:
- Provider:
OpenAI - API URL:
https://api.openai.com/v1 - API Key:
sk-... - Model:
gpt-4orgpt-3.5-turbo
- Provider:
-
Get API key from console.anthropic.com
-
Configure SILENTCHAIN:
- Provider:
Claude - API URL:
https://api.anthropic.com/v1 - API Key: Your Anthropic API key
- Model:
claude-3-5-sonnet-20241022
- Provider:
-
Get API key from makersuite.google.com
-
Configure SILENTCHAIN:
- Provider:
Gemini - API URL:
https://generativelanguage.googleapis.com/v1 - API Key: Your Google API key
- Model:
gemini-1.5-pro
- Provider:
| Setting | Description | Default |
|---|---|---|
| AI Provider | AI service to use | Burp AI |
| Passive Analysis | Auto-analyze in-scope proxy traffic | Off (opt-in) |
| API URL | Provider endpoint (external providers) | (provider default) |
| API Key | Authentication key (external providers) | (empty) |
| Model | AI model name (external providers) | (provider default) |
| Max Tokens | Response length limit | 2048 |
| Sanitizer | Redact secrets/PII before sending | On |
| Verbose Logging | Enable detailed logs | On |
- Traffic Interception: SILENTCHAIN monitors HTTP requests/responses through Burp Proxy
- Scope Filtering: Only analyzes in-scope targets (configure in Burp's Target Scope)
- AI Analysis: Sends request/response data to AI for security analysis
- Vulnerability Detection: AI identifies security issues based on OWASP Top 10 patterns
- Finding Generation: Creates detailed reports with severity, confidence, and remediation
- Deduplication: Prevents duplicate findings for the same URL/parameter combination
| Level | AI Confidence | Meaning |
|---|---|---|
| Certain | 90-100% | High confidence, verified vulnerability pattern |
| Firm | 75-89% | Strong indicators, likely vulnerable |
| Tentative | 50-74% | Potential issue, requires manual verification |
- Total Requests: HTTP requests analyzed
- Analyzed: Successfully processed
- Skipped (Duplicate): Prevented redundant analysis
- Findings Created: Total vulnerabilities found
- Errors: Analysis failures
- Shows currently processing requests
- Status tracking (Queued, Analyzing, Completed)
- Duration timing
- All detected vulnerabilities
- Severity-based color coding:
- 🔴 High - Critical vulnerabilities
- 🟠 Medium - Important security issues
- 🟡 Low - Minor vulnerabilities
- 🔵 Information - Security notes
- Confidence levels
- Discovery timestamps
- Real-time logging
- AI connection status
- Analysis progress
- Error messages
-
Set Target Scope
Burp → Target → Scope → Add Example: https://example.com/* -
Browse Application
- Configure browser proxy to Burp (127.0.0.1:8080)
- Navigate through the target application
- SILENTCHAIN analyzes in the background
-
Review Findings
- Check
SILENTCHAIN→Findingspanel - Or
Target→Issue Activity(integrated with Burp)
- Check
Right-click any request in:
- Proxy History
- Site Map
- Repeater
Select: SILENTCHAIN - Analyze Request
This forces analysis even if the URL was previously scanned.
- Select a finding in the Findings panel
- Review the detailed description
- Check affected parameters
- Follow CWE/OWASP links for more information
- Manually test using Burp Repeater/Intruder
| Feature | Community (Free) | Professional |
|---|---|---|
| AI-Powered Passive Analysis | ✅ | ✅ |
| OWASP Top 10 Detection | ✅ | ✅ |
| Multi-AI Support | ✅ | ✅ |
| Professional UI | ✅ | ✅ |
| CWE/OWASP Mapping | ✅ | ✅ |
| Deduplication | ✅ | ✅ |
| Phase 2 Active Verification | ❌ | ✅ |
| Advanced Payload Libraries | ❌ | ✅ |
| WAF Detection & Evasion | ❌ | ✅ |
| Out-of-Band (OOB) Testing | ❌ | ✅ |
| Burp Intruder Integration | ❌ | ✅ |
| Automatic Fuzzing | ❌ | ✅ |
| Priority Support | ❌ | ✅ |
SILENTCHAIN Professional adds active verification capabilities:
- 🎯 Phase 2 Verification: Automatically validates findings with exploit payloads
- 🛡️ WAF Detection: Identifies and adapts to web application firewalls
- 📚 Curated Payload Libraries: Battle-tested OWASP payloads
- 🌐 OOB Testing: Detects blind vulnerabilities (SSRF, XXE, etc.)
- 🔄 Burp Intruder Integration: Auto-configures fuzzing attacks
- ⚡ Smart Fuzzing: AI-generated payloads for maximum coverage
See it in action — watch the full SILENTCHAIN Professional demo to see AI-powered active verification, WAF evasion, and automated fuzzing at work.
Contact us for commercial licensing and professional editions: [email protected]
Solution:
- Check AI provider is running (Ollama:
ollama list) - Verify API URL is correct
- For cloud providers, confirm API key is valid
- Check network connectivity
Solution:
- Verify target is in scope (
Target→Scope) - Ensure traffic is flowing through Burp Proxy
- Check Console for errors
- Try manual analysis (right-click →
SILENTCHAIN - Analyze Request)
Solution:
- Confirm the extension type was set to Java when loading the
.jar - Verify Burp Suite is current (2025.2+ for the Burp AI provider) with a Java 21 runtime
- Review Extensions → Installed → (SILENTCHAIN Community) → Errors / Output
- Re-download the
.jarif the file may be corrupted
Solution:
- Reduce Max Tokens setting (Settings → AI Provider)
- Clear completed tasks regularly
- Use lighter AI models (e.g.,
llama3instead ofdeepseek-r1)
Enable verbose logging:
Settings→Advanced- Check
Verbose Logging - Review Console for detailed output
This project does not accept outside contributions. See CONTRIBUTING.md for details.
- Check existing issues
- Create a new issue with:
- Burp Suite version
- SILENTCHAIN version
- AI provider/model
- Steps to reproduce
- Error messages (from Console)
Open an issue with tag enhancement:
- Describe the feature
- Explain use case
- Provide examples if possible
SILENTCHAIN AI™ CE is source-visible but proprietary software. By using this software, you agree to the terms in the LICENSE file.
PortSwigger Ltd. is granted explicit permission to redistribute, host, and bundle this software within Burp Suite and the BApp Store free of charge to users. All other redistribution is prohibited without written permission.
Do not use this software for unauthorized access or activities outside systems you own or have explicit permission to test.
See PRIVACY.md for the full privacy notice, including the per-provider data-residency table and your responsibilities when scanning sensitive targets.
SILENTCHAIN analyzes HTTP requests and responses intercepted by Burp Suite. Depending on the AI provider you select, this data may be transmitted to third-party cloud services.
| Provider | Data Destination | Data Transmitted |
|---|---|---|
| Ollama | Local machine only | Nothing leaves your machine |
| OpenAI | OpenAI, L.L.C. servers (api.openai.com) |
HTTP request/response content from in-scope targets |
| Claude | Anthropic, PBC servers (api.anthropic.com) |
HTTP request/response content from in-scope targets |
| Gemini | Google LLC servers (generativelanguage.googleapis.com) |
HTTP request/response content from in-scope targets |
| Azure OpenAI | Your Azure OpenAI / Foundry resource | HTTP request/response content from in-scope targets |
| Burp AI | PortSwigger Burp AI (in-process) | HTTP request/response content from in-scope targets |
When a cloud AI provider is selected, SILENTCHAIN sends the HTTP request method, URL, headers, body, and response data for each in-scope request to the provider's API for analysis. The built-in DataSanitizer (enabled by default) redacts API keys, credentials, session tokens, and other sensitive patterns before transmission, but it cannot guarantee removal of all sensitive data from request/response bodies.
Do not submit regulated data to cloud AI providers. This includes:
- PHI (Protected Health Information) under HIPAA
- PCI DSS cardholder data (credit card numbers, CVVs, etc.)
- EU personal data subject to GDPR (Art. 13 requires disclosure of sub-processors)
- CCPA-covered personal information (Cal. Civ. Code 1798.100 et seq.)
If your target application processes any of the above data categories, you must use a local AI provider (Ollama) or ensure you have appropriate data processing agreements with the cloud provider and legal authorization to transmit such data.
SILENTCHAIN itself does not collect, store, or transmit any usage data, telemetry, or analytics. All data flows are directly between your Burp Suite instance and your selected AI provider.
- Use Ollama for sensitive or regulated environments (100% local, private)
- Enable DataSanitizer (on by default) when using cloud providers
- Review your AI provider's data retention and privacy policies before use
- Never test production systems without authorization
- Sanitize findings and logs before sharing externally
- 📚 Documentation: Documentation
- 🐛 Issues: GitHub Issues
- ✉️ Email: [email protected]
- ⭐ Star this repository
- 👁️ Watch for updates
- 🐦 X (Twitter): @silentchainai
Built by:
- @xer0dayz at @Sn1perSecurity LLC
Built with:
- Burp Suite by PortSwigger
- Ollama for local AI
- OpenAI for GPT models
- Anthropic for Claude
- Google for Gemini
Inspired by the security community's dedication to making the web safer.
"SILENTCHAIN AI™", "SILENTCHAIN™", and the SILENTCHAIN AI logo are trademarks of SN1PERSECURITY LLC. Unauthorized use is prohibited.
See NOTICE for third-party trademark attributions.
SILENTCHAIN AI™ - Intelligent Security Testing for the Modern Web
Website • Documentation • Professional Edition • Professional Demo
Copyright © 2026 SN1PERSECURITY LLC. All rights reserved.