Hi, everyone. I’ve put together a tool that will help many web and API penetration testers solve the problem of integrating AI into their workflow.
BurpSqueezer is a utility that lets you “compress” the HTTP traffic you need for your work (which can take up tens or even hundreds of megabytes) into a small `.md` report, generated specifically for AI processing.
I haven’t hardcoded anything into the code. (Well, almost—but only to automatically filter out unnecessary traffic like CDN requests, etc.) All the logic is based on universal approaches that allow you not only to “filter out” the unnecessary but also to establish connections between endpoints (especially useful when testing APIs or business logic).
The reports themselves are compressed to incredibly small sizes. When I tested in normal mode, I managed to compress my working dump from 26.7 MB to 35 KB (the result was 745 times smaller than the original dump). Different modes may yield different results, but what they’ll have in common is that almost any neural network will be able to read and understand them. (Seriously. When I tried to upload the original traffic dump to OpenCode, I couldn’t do it because of file size limitations.)
There are some important limitations, though.
BurpSqueezer is primarily designed for large HTTP datasets, especially APIs and applications with meaningful business logic. If you give it a relatively small or structurally simple dump — for example, a website with little backend logic and mostly static or repetitive traffic — the results may be much less useful. There simply may not be enough relationships and structure for the analysis to extract.
It is also not an autonomous pentesting tool. It doesn’t send requests or attack the target. It takes traffic you have already captured and authorized to analyze, processes it, and produces a much more compact representation that can then be given to an LLM for further analysis.
I built this because I wanted AI to be able to work with real Burp traffic without having to feed it tens of megabytes of raw XML and expect it to figure everything out from scratch.
The project is open source, and I’d really appreciate it if people working with Burp, API security, business logic, or AI-assisted pentesting could try it and tell me what works, what doesn’t, and where the output could be improved.
Hi, everyone. I’ve put together a tool that will help many web and API penetration testers solve the problem of integrating AI into their workflow.
BurpSqueezer is a utility that lets you “compress” the HTTP traffic you need for your work (which can take up tens or even hundreds of megabytes) into a small `.md` report, generated specifically for AI processing.
I haven’t hardcoded anything into the code. (Well, almost—but only to automatically filter out unnecessary traffic like CDN requests, etc.) All the logic is based on universal approaches that allow you not only to “filter out” the unnecessary but also to establish connections between endpoints (especially useful when testing APIs or business logic).
The reports themselves are compressed to incredibly small sizes. When I tested in normal mode, I managed to compress my working dump from 26.7 MB to 35 KB (the result was 745 times smaller than the original dump). Different modes may yield different results, but what they’ll have in common is that almost any neural network will be able to read and understand them. (Seriously. When I tried to upload the original traffic dump to OpenCode, I couldn’t do it because of file size limitations.)
There are some important limitations, though.
BurpSqueezer is primarily designed for large HTTP datasets, especially APIs and applications with meaningful business logic. If you give it a relatively small or structurally simple dump — for example, a website with little backend logic and mostly static or repetitive traffic — the results may be much less useful. There simply may not be enough relationships and structure for the analysis to extract.
It is also not an autonomous pentesting tool. It doesn’t send requests or attack the target. It takes traffic you have already captured and authorized to analyze, processes it, and produces a much more compact representation that can then be given to an LLM for further analysis.
I built this because I wanted AI to be able to work with real Burp traffic without having to feed it tens of megabytes of raw XML and expect it to figure everything out from scratch.
The project is open source, and I’d really appreciate it if people working with Burp, API security, business logic, or AI-assisted pentesting could try it and tell me what works, what doesn’t, and where the output could be improved.
Check out GitHub for more information about BurpSqueezer: https://github.com/vaginskii/BurpSqueezer