Zurp Java Ext Automates CSRF Handling in Burp for Vetted Meta Researchers
Open-source Java extension integrates Meta APIs with Burp Suite workflows for vetted security researchers conducting authorised testing.
Key points
- Zurp operates as a Burp Suite Java extension and provides Model Context Protocol servers for AI agents.
- The toolkit automates CSRF token handling and manages test assets within Meta’s approved testing environment.
- Designed exclusively for vetted researchers, it restricts access to data linked to the tester’s own authorised account.
Meta has released Zurp, an open-source toolkit that integrates Burp Suite workflows with artificial intelligence coding agents for approved bug bounty research. According to Cyber Security News, the project is designed specifically for vetted researchers participating in Meta’s bug bounty programme. The tool consolidates multiple research functions, aiming to reduce the operational friction caused by switching between separate applications, login sessions, and authentication tokens while testing Meta-owned targets.
Root cause
The development addresses the complexity researchers face when inspecting web traffic across Meta’s diverse service ecosystem. Zurp functions as a Java extension within Burp Suite while simultaneously offering Model Context Protocol servers for AI agents. This architecture allows a researcher to examine captured traffic in Burp Suite while utilising the same approved Meta APIs and access tokens through an AI coding assistant. The tool is strictly intended for data and test assets linked to the researcher’s own authorised account, establishing a clear boundary for safe and legal security testing.
Attack path
At the core of the project is the Meta View tab, which assists researchers in interpreting identifiers found within captured requests and responses. According to the documentation, this feature helps decode URLs, GraphQL doc_id values, object IDs, and operations. In practical terms, this functionality reduces the time required to identify unfamiliar values when reviewing large volumes of traffic from Facebook, Instagram, or other Meta services. The tool supports automated handling of anti-CSRF values to assist with authorised replay testing.
Affected versions
The toolkit includes several distinct capabilities that can be used individually or in combination within a single research workflow. These include Meta Context, which explains identifiers in a request, and FBDL, which helps researchers create and manage test accounts and assets allowed for use in Meta’s testing environment. SPARTA provides leads that may help researchers identify areas needing closer review, then queues proof-of-concept work directly into Burp Suite Organizer. The system also supports an AI-assisted path through three separate MCP servers: meta-context, fbdl, and sparta.
Mitigation
- Configure Burp Suite to use the Java extension for automated handling of anti-CSRF values.
- Ensure all testing is conducted using data and assets linked to the researcher’s own authorised account.
- Utilise the MCP servers to integrate AI coding assistants with approved Meta APIs and access tokens.
- Separate test values by host and logged-in account to maintain stability during authorised replay testing.
What to do and how to stay safe: Meta
- Verify that any third-party security tooling used in research is explicitly approved by the target organisation’s bug bounty programme.
- Ensure that automated tools only interact with test accounts and assets provided within the authorised testing environment.
- Monitor API access tokens and authentication scopes to prevent accidental exposure of production data during research activities.
- Confirm that AI coding assistants are configured to use only approved endpoints and do not cache sensitive identifiers outside secure environments.
Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is eligible to use the Zurp toolkit?
The tool is designed exclusively for vetted researchers participating in Meta’s bug bounty programme.
What is the primary function of the Meta View tab?
It helps researchers understand identifiers such as URLs, GraphQL doc_id values, object IDs, and operations in captured traffic.
Does Zurp support automated CSRF token handling?
Yes, it collects values like fb_dtsg, lsd, and CSRF tokens to replace supported placeholders before sending requests.
