Skip to content

Commit 4ff2606

Browse files
authored
Update README.md
1 parent 051516f commit 4ff2606

File tree

1 file changed

+168
-1
lines changed

1 file changed

+168
-1
lines changed

README.md

Lines changed: 168 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,168 @@
1-
# Auto-Payload-Positioner
1+
<div align="center">
2+
3+
# Auto Payload Positioner
4+
#### A Pentester’s handy tool for Automated Insertion Point Placement
5+
6+
⚡ Fully Automated, Quick, Handy - Intruder Payload Positioner so you don't have to!
7+
8+
![GitHub contributors Auto Payload Positioner](https://img.shields.io/github/contributors/netsquare/Auto-Payload-Positioner)
9+
![GitHub all releases](https://img.shields.io/github/downloads/netsquare/Auto-Payload-Positioner/total)
10+
![GitHub release (latest by SemVer)](https://img.shields.io/github/downloads/netsquare/Auto-Payload-Positioner/latest/total)
11+
![Latest release](https://img.shields.io/github/release/netsquare/Auto-Payload-Positioner.svg)
12+
![Java 17+](https://img.shields.io/badge/Java-17%2B-blue)
13+
[![License](http://img.shields.io/:license-apache-blue.svg)](http://www.apache.org/licenses/LICENSE-2.0.html)
14+
15+
</div>
16+
17+
![Cyberpunk Auto Payload Positioner Overview](https://github.com/user-attachments/assets/cac135ef-4b88-4bef-9695-8785561639a2)
18+
Image generated using AI tools.
19+
20+
---
21+
22+
## What is Auto Payload Positioner?
23+
24+
A Burp Suite extension built on the Montoya API that automatically detects and marks “interesting” insertion points throughout an HTTP request. Rather than manually highlighting each location (headers, parameters, JSON/XML/form bodies, etc.), this extension sets payload positions for you—so you can focus on testing vulnerabilities, not on placement.
25+
26+
Watch the demo!
27+
28+
[https://github.com/user-attachments/assets/d50251b8-6b1c-4341-b18e-ae54eb24a847](https://github.com/user-attachments/assets/d081004c-6416-43f1-b66c-ddd6c072ce07
29+
)
30+
31+
## Features
32+
33+
- Automatic detection of insertion points
34+
35+
- HTTP method (GET, POST, etc.)
36+
37+
- Last path segment of the URL
38+
39+
- URL query parameters
40+
41+
- Form data parameters
42+
43+
- Header values (Cookie, Authorization, and all other headers)
44+
45+
- JSON bodies (keys, values, nested objects/arrays)
46+
47+
- XML bodies (tag content, attributes)
48+
49+
- Embedded formats and key=value pairs in text/plain or mixed bodies
50+
51+
- Context-menu integration
52+
53+
- Right-click on any request in Proxy, Target, Intruder, or Repeater
54+
55+
- Select Set positions to auto-mark insertion points
56+
57+
- Intruder-ready
58+
59+
- Builds an HttpRequestTemplate with all detected ranges
60+
61+
- Sends the request directly to Intruder with your custom positions
62+
63+
- Robust range validation
64+
65+
- Filters out invalid, overlapping, or out-of-bounds ranges
66+
67+
- Ensures stable behavior even on complex requests
68+
69+
70+
## 🛠️ Getting Started
71+
72+
## 1. Downlaod from Releases: https://github.com/netsquare/Auto-Payload-Positioner/releases
73+
74+
## 2. Installation
75+
76+
https://github.com/user-attachments/assets/30e1e4a9-6105-4e89-8d4a-3e125360dfc4
77+
78+
- Load into Burp
79+
80+
- Open Burp Suite → Extensions.
81+
82+
- Click Add.
83+
84+
- Choose Java as the extension type.
85+
86+
- Select your downloaded JAR.
87+
88+
- Confirm & ensure Simple Payload Positioner appears in the list.
89+
90+
- Verify, In the Extender output tab, look for: `Simple Payload Positioner loaded successfully!`
91+
92+
## 3. Usage
93+
94+
[https://github.com/user-attachments/assets/d50251b8-6b1c-4341-b18e-ae54eb24a847](https://github.com/user-attachments/assets/d081004c-6416-43f1-b66c-ddd6c072ce07
95+
)
96+
97+
- Send or capture a request in Proxy, Repeater, Intruder, or Target.
98+
99+
- Right-click anywhere on the request.
100+
101+
- Select `Set positions` from the context menu.
102+
103+
- The extension will:
104+
105+
- Scan the request for all “interesting” parts
106+
107+
- Automatically highlight each range with Intruder markers (§)
108+
109+
- Send the templated request to Intruder
110+
111+
- Switch to Intruder, review the auto-populated payload positions, and launch your attack.
112+
113+
## Building from Source
114+
115+
```bash
116+
# Clone the repo
117+
git clone https://github.com/yourusername/simple-payload-positioner.git
118+
cd simple-payload-positioner
119+
120+
# (Maven)
121+
mvn clean package
122+
123+
The built JAR will be in target/
124+
125+
Load that JAR in Burp as described above.
126+
```
127+
128+
## To report bugs, issues, feature suggestion, Performance issue, general question, Documentation issue.
129+
- Kindly open an issue with respective template.
130+
131+
## Acknowledgment
132+
133+
This project is an extension for [Burpsuite](https://portswigger.net/burp) and leverages [Montoya API](https://github.com/PortSwigger/burp-extensions-montoya-api)
134+
135+
## 📄 License
136+
137+
Auto-Payload-Positioner and all related projects inherits the Apache 2.0, see [License](LICENSE.md)
138+
139+
## ⚖️ Legal Warning
140+
141+
**Disclaimer**
142+
143+
The burpsuite extension `Auto-Payload-Positioner` and all related tools under this project are intended strictly for educational, research, and ethical security assessment purposes. They are provided "as-is" without any warranties, expressed or implied. Users are solely responsible for ensuring that their use of these tools complies with all applicable laws, regulations, and ethical guidelines.
144+
145+
By using `Auto-Payload-Positioner`, you agree to use them only in environments you are authorized to test, such as applications you own or have explicit permission to analyze. Any misuse of these tools for unauthorized reverse engineering, infringement of intellectual property rights, or malicious activity is strictly prohibited.
146+
147+
The developers of `Auto-Payload-Positioner` shall not be held liable for any damage, data loss, legal consequences, or other consequences resulting from the use or misuse of these tools. Users assume full responsibility for their actions and any impact caused by their usage.
148+
149+
Use responsibly. Respect intellectual property. Follow ethical hacking practices.
150+
151+
---
152+
153+
## 🙌 Contribute or Support
154+
155+
## Contributing
156+
157+
[![Contributions Welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat-square)](CONTRIBUTE.md)
158+
159+
- Found it useful? Give it a ⭐️
160+
- Got ideas? Open an [issue](https://github.com/netsquare/Auto-Payload-Positioner/issues) or submit a PR
161+
- Built something on top? DM me or mention me — I’ll add it to the README!
162+
163+
## Other Projects
164+
- [The Browser Bruter](https://github.com/netsquare/BrowserBruter)
165+
166+
---
167+
168+
Built with ❤️ for all hackers!

0 commit comments

Comments
 (0)