zack0x01/burp-sectivai

选用指南

AI 根据 README 整理 · 2026/11/5 23:22:10

使用方式

作为 Burp Suite 扩展使用，通过加载 JAR 文件安装，然后在 Sectiv 标签页中配置 AI 提供商并运行扫描。

查看 README 依据

<img alt="License" src="https://img.shields.io/badge/license-MIT-blue?style=flat-square"> </p> --- <p align="center"> <img src="design/dashboard-demo.png" alt="Sectiv dashboard" width="920"> </p> ## Install (users) No JDK, no build — just load the JAR: 1. Download **`release/sectiv-1.0.0.jar`** (or get it from the GitHub Releases page). 2. Open Burp Suite → **Extensions → Installed**. 3. Click **Add** → extension type **Java** → select the JAR. 4. A **Sectiv** tab appears. Open **Settings**, paste your AI provider API key, and you're ready to scan.

部署要求

需要 Burp Suite 2026.7 或更高版本（基于 Montoya API 编译），以及 Java 21 运行时。

查看 README 依据

> The JAR is compiled against the Montoya API `2026.7` and Java 21. Use a current Burp release; older releases may reject it. ## Features - **Severity dashboard** — Critical, High, Medium, Low and Info counters, filterable tables, search, status triage (Open / Triaged / False positive / Resolved) and HTML / Markdown / JSON export. - **Scope picker** — load proxy history or site map, filter by host/path/method, restrict to Burp scope, collapse duplicate endpoints, remove static assets, and tick the requests to review.

已知限制

AI 辅助审查不能替代 Burp Scanner 或手动测试，且只能分析所选流量，无法发现流量中不存在的端点。

查看 README 依据

./gradlew test # unit + headless UI tests ./gradlew shadowJar # build the loadable extension ``` The extension JAR is written to: ``` build/libs/sectiv-1.0.0.jar ``` The JAR bundles the Kotlin runtime and a relocated copy of Jackson. The Montoya API is compiled against but not bundled; Burp provides it at runtime. ## Limitations - This is an **AI-assisted review**, not a replacement for Burp Scanner or manual testing. Validate every finding before reporting it. - The AI only reasons about the traffic you select; it cannot discover endpoints that are absent from that traffic.