This Burp Suite Extension integrates Burp Suite with the Faction assessment collaboration framework. Both generations are supported by the same extension:
- OWASP Faction (Faction 2.x) — the current, AI-assisted release with the
/api/v1REST API. - Faction (Faction 1.x) — the original release.
Faction is fully open source and free to use.
Faction allows you to:
- Automate Vulnerability Reports
- Collaborate with other pen-testers
- Track Vulnerabilties to Closure
Select the version your server runs (Faction 1.x or Faction 2.x / OWASP Faction) in the extension's Config tab; see FactionBurp/README.md for setup.
Requires Java 17+ and Maven.
git clone git@github.com:factionsecurity/Faction-Burp.git
cd Faction-Burp/FactionBurp
mvn clean package
Load target/FactionBurp-2.0-jar-with-dependencies.jar in Burp (Extensions → Add → Java).
- Select the request or reponse you want to include in your report and click 'add new finding'
- Search for existing Vulnerability Templates and select only the part you want to include in the repoort.
- Get full details of findings in burp that you and other assessors have discovered. You can even replay the request from the UI.
Finalize the report in the Faction Web Interface:
Then generate the final report
