If you haven't heard of Bambdas before check out the PortSwigger announcement first.
This Burp Suite Bambda was inspired by the below Bambda I stumbled across on github:
https://github.com/BugBountyzip/Bambdas
and this code posted on X by @irsdl:
https://x.com/irsdl/status/1729261410830725368?s=20
I took a look at both Bambdas, combined some functions, added some extra code and came up with a Bambda that:
- Identifies potentially vulnerable parameters
- Filters the requests within the http proxy history
- Applies a colour highlight for each different vuln class (SSRF, SQLi, XSS, LFI, RCE)
- If multiple classes of vulnerability apply the request is highlighted magenta
- Adds a note annotation containing the potential vuln class and the matched parameter (concatenates multiple vuln classes if present)
It's super easy to modify this function, just add in new parameters or a whole new custom array if you are looking for something specific.
