burpmap2http

README

burpmap2http

Convert Burp Suite sitemap exports into organized, human-readable HTTP request and response collections.

Features

• Streams large Burp Suite XML exports without loading the entire file into memory
• Decodes Base64-encoded requests and responses
• Pretty-prints valid JSON request and response bodies
• Organizes traffic by host and request path
• Preserves multiple requests to the same endpoint with per-endpoint indexes
• Exports JavaScript response bodies as standalone .js files
• Uses only the Go standard library

Installation

go install -v github.com/bugbountywithmarco/burpmap2http@latest

Ensure the Go binary directory is available in your PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Updating

Update to the latest published version:

burpmap2http -update

The update command requires the Go toolchain and installs the latest version into your configured Go binary directory.

Version

Show the currently installed version:

burpmap2http -version

Usage

Export a sitemap from Burp Suite

1. Open the Target tab.
2. Select Site map.
3. Select all URL items you want to export.
4. Right-click the selected items and choose Save selected items.
5. Save the export as an XML file.

Then run:

burpmap2http <input.xml> [output-dir]

The output directory is optional. When omitted, the collection is written to the current directory:

burpmap2http sitemap.xml

To select a different output directory:

burpmap2http sitemap.xml requests

The tool logs each processed item with its method, host, path, and response status.

The resulting collection follows this structure:

requests/
└── example.com/
    └── api/
        └── users/
            ├── 0/
            │   ├── request.http
            │   └── response.http
            └── 1/
                ├── request.http
                └── response.http

Query strings are retained inside request.http but are not included in directory names. Requests with the same host and path receive sequential indexes starting at 0. A response.http file is created only when the sitemap item contains a response.

Valid JSON bodies are formatted with two-space indentation. Captured Content-Length headers are preserved unchanged.

Export JavaScript bundles

Use -jsbundles to export only JavaScript response bodies:

burpmap2http -jsbundles sitemap.xml [output-dir]

Responses are selected when their request path ends in .js or their Content-Type contains javascript or ecmascript. HTTP response headers and requests are omitted. Files are organized by host and request path:

output-dir/
└── example.com/
    └── assets/
        ├── app.js
        └── app_1.js

Query strings are excluded from filenames. Duplicate paths receive a numeric suffix.

Build from source

git clone https://github.com/bugbountywithmarco/burpmap2http.git
cd burpmap2http
go build .

Development

go test ./...
go vet ./...

Security

Burp Suite exports can contain session cookies, authorization headers, request bodies, and other sensitive data. Review generated collections before sharing or committing them.

---

burpmap2http is made with 💙 by Bug Bounty with Marco and distributed under the MIT License.