burpmap2http

README

burpmap2http

Convert Burp Suite sitemap exports into organized, human-readable HTTP request and response collections.

Features

• Streams large Burp Suite XML exports without loading the entire file into memory
• Decodes Base64-encoded requests and responses
• Pretty-prints valid JSON request and response bodies
• Organizes traffic by host and request path
• Preserves multiple requests to the same endpoint with per-endpoint indexes
• Exports unminified JavaScript response bodies as standalone .js files

Installation

go install -v github.com/bugbountywithmarco/burpmap2http@latest

Ensure the Go binary directory is available in your PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Updating

Update to the latest published version:

burpmap2http -update

The update command requires the Go toolchain and installs the latest version into your configured Go binary directory.

Version

Show the currently installed version:

burpmap2http -version

Usage

Export a sitemap from Burp Suite

1. Open the Target tab.
2. Select Site map.
3. Select all URL items you want to export.
4. Right-click the selected items and choose Save selected items.
5. Save the export as an XML file.

Then run:

burpmap2http <input.xml> [output-dir]

The output directory is optional. When omitted, the collection is written to the current directory:

burpmap2http sitemap.xml

To select a different output directory:

burpmap2http sitemap.xml requests

The tool logs each processed item with its method, host, path, and response status.

The resulting collection follows this structure:

requests/
└── example.com/
    └── api/
        └── users/
            ├── 0/
            │   ├── request.http
            │   └── response.http
            └── 1/
                ├── request.http
                └── response.http

Query strings are retained inside request.http but are not included in directory names. Requests with the same host and path receive sequential indexes starting at 0. A response.http file is created only when the sitemap item contains a response.

Valid JSON bodies are formatted with two-space indentation. Captured Content-Length headers are preserved unchanged.

Export JavaScript bundles

Use -jsbundles to export only JavaScript response bodies:

burpmap2http -jsbundles sitemap.xml [output-dir]

Responses are selected when their request path ends in .js or their Content-Type contains javascript or ecmascript. HTTP response headers and requests are omitted, and each bundle is parsed and unminified before it is saved. Files are organized by host and request path:

output-dir/
└── example.com/
    └── assets/
        ├── app.js
        └── app_1.js

Query strings are excluded from filenames. Duplicate paths receive a numeric suffix.

Build from source

git clone https://github.com/bugbountywithmarco/burpmap2http.git
cd burpmap2http
go build .

Development

go test ./...
go vet ./...

Security

Burp Suite exports can contain session cookies, authorization headers, request bodies, and other sensitive data. Review generated collections before sharing or committing them.

---

burpmap2http is made with 💙 by Bug Bounty with Marco and distributed under the MIT License.