I Built a Burp Suite Extension to Solve One of the Most Common Pentesting Problems

Day 1 of Solving Real Cybersecurity Problems

Being a pentester, I've faced a lot of challenges while testing web applications. But there's one problem that has followed me throughout my career:

How do I know I actually tested everything?

You can spend hours — or even days — testing an application. You intercept hundreds of requests, send endpoints to Burp Repeater, manipulate parameters, review JavaScript files, and test different attack scenarios. But at the end of the assessment, there's still that uncomfortable question:

"Kuch reh toh nahi gaya?"

Did I miss an endpoint?

Did I forget to test a parameter?

Was there an API hidden inside a JavaScript file that I never looked at?

And there's an even bigger problem when you're doing professional security assessments. Your team lead or client might ask:

"Can you show me the coverage? How do we know all the endpoints were actually tested?"

Saying "Yes, I tested everything" isn't exactly measurable evidence.

The Problem: Pentest Coverage Tracking

Traditional web application pentesting involves a lot of manual work.

Burp Suite gives us excellent tools for intercepting, analyzing, and modifying requests — but keeping track of what has actually been tested can become difficult as the application grows.

This becomes especially noticeable when you have:

Hundreds of API endpoints
Multiple parameters per endpoint
Large JavaScript bundles
Several days of testing
Multiple testers working on an assessment

So I wanted something simple that could sit inside my existing Burp workflow rather than adding another complicated process.

So, I Built a Burp Suite Extension

For Day 1 of Solving Real Cybersecurity Problems, I decided to build a simple Burp Suite extension focused specifically on pentest coverage tracking.

The idea is straightforward:

1. Track Tested and Untested Endpoints

The extension keeps track of endpoints discovered during the assessment and helps identify which ones have been tested and which ones may still require attention.

2. Track Repeater Activity

Sending a request to Repeater is often where the actual manual testing begins.

The extension can use this activity to help build a picture of which endpoints you've actively worked on.

3. Track Parameter Testing

Testing /api/user?id=123 isn't necessarily complete just because you opened the endpoint.

The parameters themselves matter.

The goal is therefore to track parameters that were actually modified during testing, providing more granular coverage than simply marking an endpoint as "done."

4. Include Endpoints Found in JavaScript

JavaScript files can reveal APIs and routes that aren't immediately visible while browsing an application.

If an endpoint is discovered inside a JS file, it can be added to the coverage list so that it doesn't silently disappear from the assessment workflow.

5. Export Coverage to Excel

At the end of the assessment, the complete coverage information can be exported into an Excel file.

This gives you something much more useful than:

"I think we tested everything."

You now have structured coverage information that can help with internal reviews, assessment evidence, handovers, and identifying remaining testing gaps.

Why I Think This Is Useful !

I didn't want to build another automated vulnerability scanner.

The goal is different. The extension doesn't replace the pentester.

It helps the pentester keep track of the work they are already doing.

Whether you're working on a professional VAPT engagement or hunting bugs independently, large applications can become difficult to track manually.

The idea is to make one question easier to answer:

What have I tested, and what have I potentially missed?

Bug Bounty or Professional Pentesting?

For bug bounty hunters, it can help organize testing when working with applications containing large numbers of endpoints.

For professional pentesters and AppSec teams, there's another benefit: coverage evidence.

Instead of relying entirely on screenshots, notes, and memory, you can maintain a more structured view of the assessment.

And if you're part of a security team, this is also something you could introduce internally to improve how testing coverage is tracked across assessments.

This Is Just Day 1

This is Day 1 of my "Solving Real Cybersecurity Problems" series.

The idea behind this series is simple:

Take problems I've actually encountered while working in cybersecurity and try to build practical solutions around them. Some solutions may be small. Some may evolve into bigger tools. But every problem will come from something cybersecurity professionals actually deal with.

For Day 1:

Problem: How do we track web application pentesting coverage?

Solution: A Burp Suite extension that helps us see what we've tested — and what we might have missed.

I've also recorded a complete demo showing how the extension works.

🎥 YouTube Demo: https://youtu.be/k_28lxTplTU?si=b_rzkpM0lZXpfDo0

Extension Link: https://github.com/codewithvamp/Burp-Pentest-Coverage-Tracker

If you're a pentester, bug bounty hunter, or AppSec professional, I'd love to know:

How are you currently tracking your pentesting coverage?

If my research, write-ups, or shared insights have helped you think more securely, improve your skills, or understand risks better, your support helps me dedicate more time to responsible research, learning, and sharing knowledge with the community.

BMC: https://buymeacoffee.com/vamproot

Let's connect: Linkedin: https://www.linkedin.com/in/vaibhav-kumar-srivastava-378742a9/