VISTA - 🎯 VISTA — AI-Powered Security Testing Assistant fo

项目说明

<di="center">

🎯 VISTA - Insight & Strategic Test Assistant

AI-Powered Security Testing Assistant for Burp Suite

![CI Build]()
![Latest Release]()
![License: MIT](LICENSE)
![Java]()

Real-time AI traffic analysis, intelligent detection, and organized testing workflows — all inside Burp Suite.

Features • Installation • Quick Start • Documentation

</div>

---

📖 O

VISTA ( Insight & Strategic Test Assistant) is a professional Burp Suite extension that enhances your security testing workflow with AI-powered intelligence. It combines real-time traffic analysis, interactive AI guidance, and practical pentesting tools to help you test faster, smarter, and more systematically.

: 2.10.27 | Status: Production Ready | Size: ~511KB

Why VISTA?

🤖 AI-Powered Traffic Analysis — Real-time HTTP traffic monitoring with AI-dri detection

💡 Interactive AI Advisor — Context-aware testing suggestions from GPT-4, Azure, or OpenRouter

🆓 FREE AI Option — Use OpenRouter with no credit card required

📝 Custom Templates — 12 built-in expert templates co the most common bug bounty

🎯 Payload Library — 80+ pre-built payloads across 8 categories with AI integration

🛡️ WAF Detection — Automatically detect and bypass 8 major WAFs

🎯 Scope-Aware — Define target scope, only analyze what matters

� Data Persistence — Auto-sa, findings, and sessions across Burp restarts

📦 Backup & Restore — Export/import all VISTA data to any location

�🚀 Zero Dependencies — Pure Java, no external libraries required

---

✨ Key Features

🌐 Intelligent Traffic Monitor (Flagship Feature)

Real-time HTTP traffic analysis powered by AI:

Automatic Detection — AI analyzes intercepted traffic and flags security issues with se ratings

Scope-Aware Analysis — Define target domains; VISTA only burns AI tokens on in-scope traffic

Hierarchical Findings Tree — Findings grouped by category with expandable detail view

Li Counter — Tab badge shows Findings (5) so you know when new issues are detected

Customizable Analysis Template — Edit the AI prompt that dri with a professional split-pane editor

Traffic Tab — Browse all captured HTTP transactions with request/response

Export & Clear — Manage findings lifecycle during engagements

🤖 AI-Powered Testing Assistant

Get intelligent, context-aware testing guidance powered by leading AI models:

Interactive AI Advisor — Analyzes HTTP requests and suggests targeted testing approaches

Multi-Request Analysis — Handle complex workflows across multiple requests

Context-Aware Suggestions — AI adapts based on response patterns and findings

Follow-Up Con — Interactive chat mode for deeper analysis

Attach from Repeater — Send requests to AI without losing con context

Supported AI Pro:

OpenAI (GPT-4, GPT-4o, GPT-4o-mini)

Azure OpenAI Service (Enterprise deployments)

OpenRouter (500+ models, 2 FREE models a) ⭐

📝 Custom AI Prompt Templates

Accelerate your testing with pre-built and custom templates:

12 Built-in Expert Templates:

XSS - DOM Based (comprehensive DOM XSS testing)

XSS - Reflected Expert (ad reflected XSS with WAF bypass)

SQL Injection Expert (PortSwigger/OWASP-grade methodology)

SSRF Expert (cloud metadata, IP obfuscation, blind SSRF)

IDOR / BOLA Expert (object-le, ID manipulation)

SSTI Expert (engine fingerprinting, sandbox escape, RCE)

Auth Bypass Expert (login flaws, 2FA bypass, pri escalation)

File Upload Expert (extension bypass, web shell, path tra)

Race Condition Expert (TOCTOU, Turbo Intruder, double-spend)

JWT / OAuth Expert (algorithm confusion, token manipulation)

API Security Expert (OWASP API Top 10, mass assignment, GraphQL)

Traffic - Bug Bounty Hunter (AI-powered traffic analysis)

Template Features:

35 dynamic ({{URL}}, {{METHOD}}, {{REQUEST}}, {{RESPONSE}}, etc.)

Create and sa templates

Search and filter functionality

Import/Export for team collaboration

Usage tracking and fa

🎯 Payload Library Manager

Organize and manage your testing payloads efficiently:

80+ Built-in Payloads across 8 Libraries:

XSS Reflected (Basic, Event Handlers, Encoding Bypasses)

XSS Stored (Persistent payloads)

SQL Injection - Error Based (MySQL, PostgreSQL, MSSQL, Oracle)

SQL Injection - Blind (Boolean-based techniques)

SSTI (Jinja2, Twig, Freemarker, )

SSRF (Cloud Metadata, Internal Networks)

Command Injection (Linux, Windows)

XXE (XML External Entity payloads)

Library Features:

Create custom payload collections

Bulk import with auto-detection

AI-powered payload suggestions

Context-aware filtering

Export/Import for sharing

🛡️ Ad Security Features

WAF Detection & Bypass:

Automatically detects 8 major WAFs (Cloudflare, AWS WAF, ModSecurity, Akamai, Imper, Sucuri, F5 BIG-IP)

250+ real-world bypass techniques from PayloadsAllTheThings

WAF-specific bypass suggestions

Systematic Testing:

Step-by-step methodologies for 5 types (XSS, SQLi, SSTI, Command Injection, SSRF)

Headless browser for XSS

Reflection analysis for input tracking

Seamless Burp Repeater integration

🎨 Modern User Interface

VISTA features a clean, streamlined UI with a professional status bar:

Always- Status Bar:

VISTA branding with

Live AI status indicator (● Ready / ● Not Configured)

Provider & model display

One-click jump to Settings

5 Focused Tabs:

| Tab | Purpose |
|-----|---------|
| 💡 AI Advisor | Interactive AI testing assistant with con history |
| 🌐 Traffic Monitor | Real-time traffic analysis with AI-powered findings |
| 📝 Prompt Templates | Custom AI prompt management (12 expert built-in) |
| 🎯 Payload Library | Payload organization with AI integration (80+) |
| ⚙️ Settings | AI provider configuration, connection testing, data backup & restore |

Context Menu Integration:

Right-click any request → "💡 Send to VISTA AI Advisor"

Right-click any request → "📎 Attach to Interacti"

---

🚀 Installation

Requirements

Java: 17 or higher

Burp Suite: Professional or Community Edition

Quick Install (Recommended)

Option 1: Download from Releases

1. Visit Latest Release
2. Download .10.24.jar from Assets
3. In Burp Suite: Extensions → Add → Java → Select JAR
4. VISTA tab appears in Burp with status bar

Option 2: Command Line

Build from Source

---

⚡ Quick Start

Step 1: Configure AI Provider

Go to VISTA → Settings tab (or click ⚙ in the status bar):

For OpenAI:

For Azure AI:

For OpenRouter (FREE Option): ⭐

Step 2: Start Testing

Method 1: Traffic Monitor (Passive AI Analysis)
1. Go to Traffic Monitor tab → Click "▶ Start Monitoring"
2. Configure scope (add your target domains)
3. Browse the target — VISTA automatically analyzes traffic
4. Check Findings tab for AI-detected

Method 2: AI Advisor (Interactive)
1. Right-click any request in Burp → "💡 Send to VISTA AI Advisor"
2. AI automatically analyzes the request
3. Get testing suggestions and payloads
4. Ask follow-up questions for deeper analysis

Method 3: Use Templates
1. Go to Prompt Templates tab
2. Select a template (e.g., "XSS Testing - Reflected")
3. Click "Use Template"
4. AI provides targeted testing guidance

---

🆓 FREE AI with OpenRouter

VISTA supports OpenRouter — giving you access to powerful AI models completely free!

| Feature | OpenRouter | OpenAI | Azure AI |
|---------|:----------:|:------:|:--------:|
| Cost | 🆓 FREE | 💰 Paid | 💰 Paid |
| Credit Card | ❌ Not Required | ✅ Required | ✅ Required |
| Setup Time | ⚡ 5 minutes | ⏱️ 10 minutes | ⏱️ 30+ minutes |
| Quality | ⭐⭐⭐⭐⭐ GPT-4 Level | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ |
| Context Window | 128K+ tokens | 128K tokens | 128K tokens |
| Best For | Students, Learning, Testing | Production, Enterprise | Enterprise Only |

Quick Setup (5 Minutes)

1. Go to openrouter.ai → Sign up (no credit card)
2. Visit openrouter.ai/keys → Create Key
3. In VISTA Settings: Select OpenRouter, paste key, save
4. Done — all VISTA features work for free!

A Free Models

| Model | ID | Best For |
|-------|-----|---------|
| Llama 3.3 70B (Recommended) | meta-llama/llama-3.3-70b-instruct:free | General testing, fast responses |
| DeepSeek R1T2 Chimera | tngtech/deepseek-r1t2-chimera:free | Complex analysis, WAF bypasses |

---

🎯 Supported

| | AI Guidance | Payloads | Bypass Techniques | Methodologies |
|--------------|:-----------:|:--------:|:-----------------:|:-------------:|
| Cross-Site Scripting (XSS) | ✅ | ✅ | ✅ | ✅ |
| SQL Injection | ✅ | ✅ | ✅ | ✅ |
| Ser Template Injection (SSTI) | ✅ | ✅ | ✅ | ✅ |
| Command Injection | ✅ | ✅ | ✅ | ✅ |
| Ser Request Forgery (SSRF) | ✅ | ✅ | ✅ | ✅ |
| XML External Entity (XXE) | ✅ | ✅ | ✅ | — |
| Local File Inclusion (LFI) | ✅ | — | ✅ | — |
| Insecure Direct Object Reference (IDOR) | ✅ | — | ✅ | — |
| Authentication Bypass | ✅ | — | ✅ | — |
| NoSQL Injection | ✅ | — | ✅ | — |

---

💡 Use Cases

For Penetration Testers

AI-powered traffic analysis catches what manual review misses

Interactive AI advisor for deep-di guidance

Pro libraries with WAF bypass techniques

Scope-aware analysis — no wasted tokens on irrelevant traffic

For Bug Bounty Hunters

Passive AI monitoring while you browse targets

Instant findings with se ratings

Customizable templates for focused testing

Free AI option — zero cost

For Security Teams

Standardize testing approaches with shared templates

Build team payload libraries

Consistent AI-dri across engagements

Enterprise AI support OpenAI

---

🔧 Configuration

AI Provider Settings

Cost Optimization:

Default temperature: 0.3 (focused, deterministic responses)

Efficient prompts with truncated request/response data

Scope filtering prevents unnecessary AI analysis

Recommended model: gpt-4o-mini (~$0.001-0.003 per interaction)

Data Privacy:

Requests are truncated before sending to AI

Sensiti can be filtered

No data stored by VISTA externally (only by your AI provider)

All data stored locally in ~/.vista/

Local Data Storage

VISTA persists all data locally with auto-sa 60s), shutdown hooks, and atomic writes:

Backup & Restore: Use Settings → Export Backup to save all data to any folder. Restore anytime with Import Backup.

---

📊 Technical Details

Architecture

Language: Java 17+

Framework: Swing UI

API: Burp Suite Extension API

Dependencies: Zero external dependencies (Pure Java + Burp API)

Build Tool: Maven

JAR Size: ~511KB

Total Files: 87 Ja files

Lines of Code: 28,000+

Project Structure

---

📖 Documentation

📚 Full Documentation: Adw0rm-sec.github.io/VISTA

Issues: GitHub Issues

Discussions: GitHub Discussions

Changelog: CHANGELOG.md

Contributing: CONTRIBUTING.md

Security: SECURITY.md

---

🤝 Contributing

We welcome contributions from the community! Whether it's:

🐛 Bug reports

💡 Feature requests

📝 Documentation impro

🔧 Code contributions

Please see our Contributing Guide for details.

De Setup

---

🔒 Security & Responsible Use

Disclaimer

VISTA is designed for authorized security testing only. Users are responsible for:

✅ Obtaining proper authorization before testing

✅ Complying with applicable laws and regulations

✅ Using the tool ethically and responsibly

✅ Respecting data privacy and confidentiality

For security issues, please see SECURITY.md or contact the maintainers pri.

---

📜 License

VISTA is released under the MIT License.

---

🙏 Acknowledgments

PayloadsAllTheThings — Bypass techniques and payloads

Burp Suite — Extensibility API and platform

OpenAI, Azure, OpenRouter — AI capabilities

Security Community — Testing methodologies, feedback, and inspiration

---

📞 Support & Community

💬 Discussions: GitHub Discussions

🐛 Bug Reports: GitHub Issues

📧 Contact: -sec

⭐ Star this repository to stay updated • 👀 Watch releases for new

---

<di="center">

Made with ❤️ for the Security Community

⬆ Back to Top

---

VISTA — Insight & Strategic Test Assistant

*Empowering security professionals with AI-powered intelligence*

</div>

Latest Build: 20260527-181643 | : 2.10.28 | Commit: 49a012d

项目信息

开发语言：Java

Star 数：20

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🎯 VISTA — AI-Powered Security Testing Assistant for Burp Suite. Real-time traffic analysis, 12 expert vulnerability templates, 80+ payloads, WAF detection & bypass. Supports OpenAI, Azure, and OpenRouter (FREE). Zero dependencies.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	VISTA - 🎯 VISTA — AI-Powered Security Testing Assistant fo
所属分类	安全软件
发布作者	admin
发布时间	2026-10-05 22:54:38
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	123
讨论数量	0
主题状态	正常讨论中