Yentra

Burp Suite extension + port-based highlighter: dedupes proxy history into a live unique-request feed and color-codes attacker/victim traffic by listener port (PwnFox-style). Features Live Share — the first-ever real-time peer-to-peer request sharing inside Burp Suite — plus Magic Cookie, Match & Replace, Caido-style filter palette, inline Repeater, AI bridge, and .http export for Claude Code.

Industry-first: No other Burp extension lets two testers share captured HTTP requests live, directly inside Burp. Host a server, connect to a friend, and every unique request you capture appears instantly on their screen — color-coded, deduplicated, and ready to test.

Live Share — server on port 9999 with client connected, sharing requests in real time

Received shared requests — double-click any entry to open in Repeater

What makes it unique:

• Requests arrive already deduplicated — only [YENTRA] UNIQUE entries are shared
• Auto-share mode: every new unique is forwarded to all connected peers in real time
• Re-issue received → Proxy history: replay received requests through your local proxy listener to add role tags (attacker/victim)
• Room-based relay with random 8-char IDs — drop-in, no registration
• Magenta highlights distinguish shared requests in your Yentra Live feed

1. Installation
2. 🌐 Live Share — Peer Collaboration
3. Architecture Overview
4. Yentra Config Tab
   • Behavior & Signature Fields
   • Presets
   • Stats & Header Overrides
   • History Stamping
5. Yentra Live Tab
   • Toolbar Actions
   • Inline Repeater
   • Response Info Bar
   • History Navigation
6. Bambda-Style Filter
   • Prefix Tokens
   • Filter Chips
   • Command Palette
   • Status Operators
7. IDOR / BOLA Tools
   • Magic Cookie
   • Match & Replace
8. Right-Click Actions
9. Remove from Scope
10. Yentra Share (Live Share)
11. AI Bridge (Live Export)
12. Attacker / Victim Port Highlighting
13. Body Only (Pretty JSON) Editor
14. Keyboard Shortcuts
15. Build
16. Acknowledgements

1. Burp → Extensions → Installed → Add
2. Extension type: Java
3. Download the JAR from the latest release and select it
4. Three tabs appear: Yentra, Yentra Live, Yentra Share

Yentra is built around a request pipeline that flows from capture to distribution:

Proxy Traffic → YentraEngine → [YENTRA] Stamp → Yentra Live Feed → 🌐 Live Share → Peers
 ↓ ↓
 HTTP History AI Bridge (.http)

Core components:

Verdict system:

Cross-identity dedup: When traffic arrives through role-tagged ports (attacker/victim), Cookie, Authorization, and role headers are stripped before computing the signature — so identical requests from different identities share one count (first = UNIQUE, second = DUPE x2).

Body digest safety net: When body parameters are enabled, the raw body content hash (first 4 KB) is always folded into the signature, preventing false DUPEs when Montoya cannot parse the body into parameters.

The main configuration panel — "Yentra" suite tab.

Signature fields: Method · Scheme · Host · Port · Path · Normalize numeric/UUID/hex path segments · Query param names · Query param values · Body param names · Body param values · Response status code · Response Content-Type

Filters: In-scope only · Skip static assets (.png, .svg, .jpg, .gif, .webp, .css, .scss, .js, .mjs, .woff, .ttf, .eot, .otf, .ico, .mp3, .mp4, .wav, .avi, .mov, .m3u8) · Include custom headers (comma-separated)

Live stats (refreshed every second): Total seen · Unique · Duplicates · Skipped · Tracked signatures (shown as N / cap)

Header overrides — inject custom headers into requests sent to Organizer:

• Paste raw header lines (Name: value), one per line; # comments and blank lines ignored
• Choose Replace if present, add if missing or Replace only
• Reserved headers (Host, Content-Length, Transfer-Encoding) are rejected
• Applied via right-click → Yentra → Send unique to Organizer

• Stamp existing history walks all proxy history entries and applies verdicts in-place (background thread, shows progress)
• Auto-stamp does this automatically on every extension load — handy for saved projects
• Revert strips [YENTRA] notes and/or clears highlights when those options are toggled off
• Seen-set is reset before stamping for consistent counts

An always-on, auto-refreshing feed of only the [YENTRA] UNIQUE requests. Opens as a Burp suite tab ("Yentra Live") on load. Also accessible via Ctrl+9 (in HTTP history / Site Map, with nothing selected) or the Live unique window button.

How it works:

• Push path: Every UNIQUE from the proxy handler is pushed directly into the live feed via an in-memory UniqueFeed
• Poll path: Background timer (every 1.5s) incrementally scans proxy history for entries stamped [YENTRA] UNIQUE that haven't been collected yet; full rescan every ~60s catches late "Stamp history" marks
• Both paths cross-dedupe by request identity so the same request never appears twice

A full Repeater-style interface embedded below the table:

• Request (left) — editable Montoya HTTP request editor
• Response (right) — read-only response viewer with prominent status bar
• Send ▶ button fires via Burp's HTTP client; lands in Logger, not Proxy history
• Safe body editing — automatically recalculates an existing Content-Length from the raw body bytes, so spaces, Unicode, and other edits are sent correctly over HTTP/1.1 and HTTP/2
• Latest-response ownership — slow responses from older sends cannot overwrite a newer request, response, or table selection
• Keyboard shortcuts: Cmd+Space / Ctrl+Space (primary), Ctrl+Enter (fallback)
• Reset restores the request to its original state from the table

Shown above the response editor with status-code-colored text:

• ◀ ▶ buttons navigate through sent request history (append-style)
• Keyboard: Alt+Left / Alt+Right
• History prunes forward entries when a new request is sent after navigating back (browser-style)

A Caido-inspired filter system with prefix tokens, chips, and a command palette.

Type prefix:value tokens (case-insensitive) into the search bar. Multiple tokens combine with AND logic. Plain text becomes substring search across all columns + request body + response body.

Toggle buttons in the filter bar:

Click the search bar (or press Down arrow when focused) to open the filter command palette. Four categorized groups with 18 options, each showing a prefix badge, label, and description. Navigate with arrow keys, select with Enter or click.

Groups: HTTP · Request · Yentra · Advanced

Type standalone comparison operators for status-based filtering:

Reissues selected requests with a user-supplied auth set swapped in.

1. Select requests in Yentra Live
2. Click Magic Cookie
3. Paste auth headers — one Name: value per line (# comments ignored)
4. The auth set is remembered across sessions
5. Results stream into a new window — each response lands as it arrives

Strips the request's existing Cookie and Authorization (plus any header you list), then adds only your supplied credentials. Method, path, body, and other headers are unchanged. The dialog stays open after sending so you can swap values and send again.

Swaps an ID or token in the path/query, body, headers, or any combination — then reissues.

1. Select requests → Match & Replace
2. Enter Match text and Replace text
3. Choose Path/query, Body, Headers, or any combination
4. Optionally tick regex
5. Click Replace & send

Only requests containing the match are sent (others skipped). The dialog stays open — change values, select new rows, send again. Settings are remembered across sessions.

Headers rewrites every header value (Cookie, Authorization, X-User-Id, ...), so a request whose token lives only in a header is actually sent instead of being skipped. This is what you want after Magic Cookie: tick Headers to re-swap the session/token the cookie change just put in place, then reissue.

Available in HTTP history, Site Map table, and Site Map tree via the Yentra submenu:

Also available as a right-click popup on the Yentra Live table: Send to Repeater, Share, Remove host from scope, Remove path from scope.

What gets excluded:

• Remove host from scope → scheme://host:port/ (default ports 80/443 stripped) — prefix-matches all paths on that host
• Remove path from scope → scheme://host:port/path (query stripped, trailing slashes trimmed) — prefix-matches that path and sub-paths

A confirmation dialog shows exactly what will be excluded. Multi-selection deduplicates unique hosts/paths.

⚡ The only Burp extension with real-time peer-to-peer HTTP request sharing. Two testers, two Burp instances, one shared feed. No exports, no copy-paste, no waiting.

1. Tester A starts a server on the Yentra Share tab (port 9999)
2. Tester B connects to Tester A's address
3. Tester A browses the target — every [YENTRA] UNIQUE request appears instantly in Tester B's Yentra Live feed, color-coded magenta
4. Tester B can replay received requests through their own proxy listener to add role tags (attacker/victim)
5. Both testers see identical, deduplicated feeds in real time

cd relay-server
docker compose up -d

The relay is a lightweight Java HTTP server. Two peers connect to it with the same room ID and messages are brokered in real time. No database, no auth, no accounts — just room-based pub/sub. Works behind any NAT or firewall.

• Pair testing: One tester browses as attacker, the other as victim — both see identical traffic
• Training / mentoring: Senior tester shares live traffic with a junior in real time
• Distributed testing: Two testers on different networks testing the same target simultaneously
• Demo / presentation: Share your Burp session live without screen sharing

Burp's MCP server cannot see custom extension windows, so Yentra uses the filesystem as the AI bridge:

~/.yentra/<burp-project-name>/
 live-unique.http ← every unique request, as it arrives
 selection.http ← current table selection

The folder is named after the current Burp project. Each entry is a ####-delimited request+response block prefixed with a case manifest — four fields the AI reads before touching payloads:

1. Source request — method + URL
2. Identity role — attacker / victim (from X-AI-Use header or [attacker]/[victim] tag)
3. Why it's unique — the Yentra verdict and signature rationale
4. Replay command — a ready-to-run curl (auth + body included; body omitted if > 4 KB)

Workflow: Open Yentra Live → it fills with [YENTRA] UNIQUE requests and mirrors them → in Claude Code: "read ~/.yentra/<project>/live-unique.http". The toggle is on by default in live mode. Tick Responses: body only, pretty JSON when saving for AI to get clean JSON without headers.

For multi-account IDOR/BOLA testing where each account browses through its own proxy listener port.

Default port rules (edit PORT_RULES in PortHighlightHandler.java and rebuild):

Row colors are per-port and per-verdict, applied after classification. The Highlight rows toggle must be on. Port rules are logged to extension output on load.

A read-only response-viewer tab available everywhere a response is shown:

• Shows only the body (no headers)
• Strips JSON XSSI guards ()]}', for(;;);, while(1);)
• Pretty-prints JSON with zero-dependency re-indenter
• Opt-in when you Save for AI: tick Responses: body only, pretty JSON

Requires JDK 21+.

./gradlew build

Output: build/libs/yentra-0.1.0-SNAPSHOT.jar

• Yentra builds on burp-dedupe by sw33tLie — the original deduplication engine. MIT-licensed.
• The per-request case manifest in the AI export was suggested by Timur Yessenov (@Timur_Yessenov) .
• The Body Only (Pretty JSON) response tab was inspired by rikeshbaniya 's Burp extension.