sleeyax/burp-awesome-tls

Health v2 · maintenance only

Adoption not part of the score

1889 stars · 118 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Burp Suite extension that hijacks Burp's HTTP and TLS stack to spoof any browser's TLS fingerprint (JA3). It helps evade WAF bot detection like Cloudflare, Akamai, and DataDome during web security testing.

Use cases

• bypass cloudflare bot detection in burp suite
• spoof browser tls fingerprint ja3
• evade waf while pentesting with burp
• avoid tls fingerprinting during web scraping
• make burp requests look like a real browser
• bypass akamai and datadome bot protection

When to choose

• you use Burp Suite for web security testing against WAF-protected targets
• you need customizable JA3/TLS client hello spoofing without forking Burp
• you want a plug-and-play extension that works on Burp Pro and Community

When to avoid

• you don't use Burp Suite and need a standalone TLS spoofing proxy
• you need a general-purpose HTTP client library rather than a Burp extension
• your use case is not security testing (evasion tooling may violate target policies)

Facets

plugin · maturity active

security networking proxy middleware security penetration-testing web-development cross-platform jvm go burp-suite burp-extension tls-fingerprinting ja3 waf-bypass utls anti-bot-evasion penetration-testing desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="sleeyax/burp-awesome-tls")