BurpKit: Using WebKit to Own the Web

Limitations of Headless and Static Web Testing

Nadeem Douba addresses the shortcomings of traditional web application penetration testing tools when evaluating modern, single-page JavaScript applications. Standard proxy scanners struggle to evaluate complex DOM mutations, client-side event handlers, and asynchronous single-page application (SPA) state changes.

Integrating Headless WebKit into Burp Suite

Douba introduces BurpKit, an open-source extension that embeds a complete WebKit browser engine directly into PortSwigger's Burp Suite. By providing full DOM rendering, JavaScript execution, and bidirectional proxy communication, BurpKit allows security testers to inspect and manipulate rendered application state programmatically.

Automating DOM-Based Cross-Site Scripting Exploitation

BurpKit excels at detecting and exploiting client-side security flaws such as DOM-based Cross-Site Scripting (DOM XSS), client-side prototype manipulation, and open redirects. Testers can inject dynamic instrumentation scripts into the browser runtime to monitor JavaScript sinks, taint-trace sensitive variables, and verify exploitability in real time.

Extending Security Tooling with Scriptable Browser Contexts

The presentation showcases how developers and security researchers can leverage BurpKit's API to build custom automated workflows, perform authenticated screen captures, and simulate user interaction workflows. The extension bridges the gap between passive proxy analysis and dynamic client-side vulnerability assessment.

(AI summary — Gemini 3.8 Flash)