RedPick for Burp Suite: AI Findings Inside Your Proxy

Most pentesters live in Burp Suite. This post explains how RedPick plugs into it: what the extension sends, what it brings back, and why it never adds traffic you didn't ask for.

Direct answer: The RedPick Burp Suite extension connects Burp to a RedPick engagement. It sends your proxy history to RedPick for passive AI analysis without sending extra requests to the target, and publishes RedPick findings as native Burp issues with evidence, proof of concept, severity and remediation. It can import completed engagements into Burp's history and site map, open requests in Repeater or Intruder on click, and let several testers and the dashboard work on the same engagement. Customers download it from the RedPick dashboard.

The short version. Keep working in Burp the way you do today. RedPick reads what you capture, analyzes it in the background, and puts verified findings where you already look for them. Nothing is replayed against the target unless a person explicitly decides to.

---

Why a Burp Suite extension?

Autonomous pentesting and manual testing are often presented as alternatives. In practice, most security teams and pentest firms use both. An agentic platform covers breadth and repeatability, and a skilled tester follows the strange behavior that only a human notices. The friction comes from the gap between them: findings in one place, traffic in another, notes in a third.

Burp Suite is where most web testers spend their day. PortSwigger's Montoya API lets extensions plug into the proxy, the site map, the issue list and the testing tools. So instead of asking testers to move to a new interface, we brought RedPick into Burp.

The extension does three things:

1. Burp to RedPick: captured traffic goes to your RedPick engagement for analysis.
2. RedPick to Burp: findings and completed engagements come back as native Burp data.
3. Tester to tester: several Burp installs and the RedPick dashboard share one engagement.

Proxy history in, passive AI analysis out

Once the extension is paired with an engagement, it captures completed responses from Burp's proxy history and sends them to RedPick. You can also choose to capture responses from Repeater, Intruder, Scanner, Sequencer and other extensions, each with its own toggle.

On the RedPick side, every captured request is stored first and analyzed afterwards. The AI analysis is passive: it works only on the request and response you already have. It looks for signs of vulnerabilities, tags sensitive contexts such as authentication, payment, admin and API endpoints, and extracts injection points from URL and body parameters, JSON fields, cookies and path identifiers.

Here is what passive means in practice:

• No extra traffic to the target. Analysis does not send a single request to the application under test.
• Scope stays yours. Capture respects Burp's target scope, with an explicit option to add the engagement's target to scope, or a fallback rule if you prefer.
• Active checks are a separate decision. If you want RedPick to actively probe something, that is an explicit action from the dashboard or through MCP, with its own confirmation. It never happens because a request passed through your proxy.
• Sensitive data is handled carefully. Credentials are redacted on the server, binary content is filtered out, and you can cap the response size that gets captured.

For teams testing production systems, or working under strict rules of engagement, this is the property that matters most. Plugging RedPick into Burp doesn't change how much traffic hits the target.

Findings as native Burp issues

The other direction is where testers save time. When RedPick confirms a finding on your engagement, the extension publishes it in Burp as a native issue, next to Burp Scanner's own results.

Each issue carries what you would expect from a pentest report, rendered properly inside Burp:

• a description and the business impact
• reproduction steps and a proof of concept
• the HTTP evidence that demonstrates the issue
• severity
• remediation guidance and references

When RedPick revises a finding, for example after a retest or a severity change, the same Burp issue is updated instead of a duplicate being added. Findings declared as false positives or duplicates are not published. Publishing an issue never replays the request: the extension attaches the HTTP evidence it already holds.

If you prefer a lighter touch, findings can also be mirrored to the Burp event log, with counters and a list of recent findings in the extension tab.

Import completed engagements offline

Not every engagement happens while Burp is open. A RedPick engagement can be exported and imported into Burp later, even without a live connection.

The extension accepts one or more engagement archives at once. Each import is validated, then added to a dedicated RedPick history table and to Burp's Site map, so you can browse what RedPick tested the same way you browse your own crawl. Different engagements can sit side by side. Findings appear with severity columns, color coding and filtering, and each active finding is shown on the request that best demonstrates it, so repeated traffic doesn't look like repeated vulnerabilities.

Importing doesn't send anything to the target. It's a safe way to review an automated assessment in the tool you know, write up a report, or plan manual follow-up work.

Open in Repeater or Intruder, on your click

Once you find a request worth exploring, select it and open it in Repeater or Intruder. The extension prepares the tab. It does not send the request or start an attack. You decide what happens next, the same as with any other request in Burp.

This is the natural bridge between automated and manual work. RedPick shows you where an authorization check looks weak, and you push on it with your own payloads and judgment.

Collaboration across Burp installs and the dashboard

Pentests are rarely one-person jobs. The extension has a collaboration tab that connects every tester on an engagement:

• requests and findings shared from the dashboard or from another tester's Burp show up in your Burp
• you can see who else is active, who owns an item, its state and its comments
• shared requests open in Repeater or Intruder only when you choose to

Collaboration updates carry only metadata. The full HTTP evidence is fetched when you open an item, which keeps the extension quick on large engagements. Sync state survives a Burp restart, so you don't get the same events twice after reconnecting.

For pentest firms, this means a lead can review RedPick findings in the dashboard, share the interesting ones with the team, and see each tester's progress without everyone exporting project files to each other.

One-click pairing, short-lived credentials

Setup is quick. Install the extension once on each workstation. Then, for each engagement:

1. Click Open in Burp on the engagement in the RedPick dashboard.
2. In Burp, open the extension tab and paste the configuration from your clipboard.

That's all. The status changes to connected after the first captured request.

Behind that click, the extension uses short-lived credentials. The pairing link works once and expires within minutes. It is exchanged for credentials that the extension renews by itself, so you don't paste long-lived API keys into Burp. Pairing is tied to RedPick's production dashboard, and when an engagement is locked to a target, the extension enforces that lock automatically.

The extension is also built to survive real network conditions. Captured traffic is queued on disk, sent in batches, retried when delivery fails, and acknowledged item by item, so a flaky connection or a Burp restart doesn't lose data or send it twice.

Signed updates, no surprises

Security tools should be careful about updating themselves. The extension checks for new versions against signed update information and tells you when one is available. It never downloads, replaces or reloads itself automatically. You choose when to install the update. The extension is only distributed to authenticated customers through the dashboard. It is not an anonymous public download.

Optional: MCP alongside Burp

If your team uses RedPick's MCP server, the two work together. An AI assistant can list the traffic and findings captured from Burp, link a request to a RedPick finding, and check the health of the connection. With your local consent, it can also open a stored request in Repeater for you. This handoff is off by default. When you enable it, it only opens a tab and never sends the request.

You don't need MCP to use the extension. It's there for teams who want an assistant to help with triage while they test.

Who it is for

• In-house security teams who run RedPick for continuous coverage and still do manual testing on critical flows.
• Pentest firms and MSSPs who use RedPick for breadth and want their consultants to work on the results in Burp.
• Bug bounty and red team practitioners who want a second, passive opinion on traffic they already captured.

If you are evaluating AI pentesting tools in general, our buyer's checklist covers the questions to ask, including how a tool fits into existing workflows.

Getting the extension

The RedPick Burp Suite extension is available to customers on eligible plans. You can download it from the RedPick dashboard and pair it with any engagement in a couple of clicks. It is built on the Montoya API and targets current Burp Suite Professional releases.

---

Related: AI pentesting buyer's checklist · Run and track pentests from your AI agents with MCP · Agentic vs automated pentesting