Burp Suite bridge¶

PDX connects to Burp Suite through a Java extension and a Python proxy bridge. This allows HTTP deltas captured during web pentests to flow through the same dual-use pipeline as HYDRA's SSH sessions.

Why Burp integration matters¶

HYDRA captures passive data — attackers come to you. But security research also requires active data — you go to the target. The Burp bridge closes that gap.

Both sources produce the same .pdx delta format, go through the same DataRouter, and feed the same training generators. A model fine-tuned on PDX data learns from both real attacker behavior (HYDRA) and professional pentest methodology (Burp).

Architecture¶

graph LR
    B[Burp Suite] --> E[Java Extension]
    E --> P[Python Proxy Bridge]
    P --> R[PDX DataRouter]
    R --> D[Defensive stream]
    R --> O[Offensive stream]

Java extension (burp_extension/pdx_burp.py + burp_java/)¶

The extension hooks into Burp's HTTP handler and extracts:

• Request method, URL, headers, body
• Response status, headers, body
• Timing information
• Identified parameters and injection points

Python proxy bridge (burp_bridge.py)¶

The bridge receives extracted data from the Java extension and:

1. Converts HTTP request/response pairs into .pdx deltas
2. Classifies each delta by type (INJECTION, AUTH_BYPASS, MISCONFIG, INFO_LEAK, etc.)
3. Generates a 16D delta vector for each observation
4. Forwards everything to the DataRouter

Delta types from Burp¶

Usage¶

# 1. Start the Python proxy bridge
python burp_bridge.py --port 8089

# 2. In Burp Suite, load the Java extension
#    Extender → Add → Python → select burp_extension/pdx_burp.py

# 3. Configure the extension to point to the proxy
#    Extension tab → PDX Bridge → Host: localhost, Port: 8089

# 4. Browse/scan targets normally in Burp
#    Every finding is automatically converted to .pdx format

# 5. Run the DataRouter on the collected data
python -m pdx.training.data_router split
python -m pdx.training.data_router generate --all

Scan specifications¶

PDX ships with 15 YAML spec files that define what to look for during a web scan:

These specs work with the PDX router — each spec defines expected vs. observed behavior, and the router scores the delta.