Burp Compliance Auditor

Autonomous compliance violation detector and legal evidence generator for Burp Suite.

Burp Compliance Auditor is a passive HTTP(S) traffic analyzer that automatically detects PII/PHI/payment data exposure and generates attorney-ready legal evidence packages for GDPR, CCPA, HIPAA, PCI DSS, SOX, GLBA, COPPA, and FERPA violations.

• Legal Compliance Audits: Automatically detect and document regulatory violations with chain of custody
• Privacy Impact Assessments: Real-time monitoring of PII/PHI exposure across all HTTP traffic
• Security Assessments: Identify unencrypted transmission of sensitive data
• Incident Response: Generate attorney-ready evidence packages with SHA256 hashes
• Bug Bounty: Document privacy violations with complete technical evidence
• Penetration Testing: Compliance-focused testing with automated violation detection

• Passive Monitoring: Zero configuration - automatically analyzes all Burp traffic
• Real-Time Detection: Instant alerts for PII/PHI/payment data exposure
• Legal Evidence: Attorney-ready packages with chain of custody and SHA256 hashes
• Multi-Regulation: Covers GDPR, CCPA, HIPAA, and PCI DSS in one tool
• Visual Dashboard: Color-coded statistics and severity-based highlighting
• Fine Exposure: Automatic calculation of maximum statutory penalties
• No Dependencies: Pure Jython - no external libraries required

• Autonomous Operation: No manual configuration or rule setup required
• Legal Focus: Evidence packages designed for legal proceedings
• Chain of Custody: SHA256 hashes and timestamps for all evidence
• Comprehensive Coverage: 9 PII types including emails, SSNs, credit cards, GPS coordinates
• Smart Detection: Context-aware compliance checking (e.g., HTTPS vs HTTP)
• Instant Feedback: Color-coded proxy history highlighting (red/orange/yellow)

1. Burp → Extender → Extensions → Add → Python
2. Select: ComplianceScanner.py
3. Browse to "Compliance Auditor" tab
4. Start browsing - violations appear automatically
5. Click "Generate Legal Package" to export evidence

• Burp Suite (Professional or Community Edition)
• Jython Standalone JAR (https://www.jython.org/download)

• Analyzes all HTTP(S) responses automatically
• No configuration required
• Works with Proxy, Repeater, Scanner, and all Burp tools

Detects 9 types of sensitive data:

• Email addresses - RFC-compliant email pattern matching
• Phone numbers - US format with optional separators
• SSN - Social Security Numbers (XXX-XX-XXXX)
• Device IDs - UUID format identifiers
• Credit cards - 16-digit card numbers with optional separators
• CVV - 3-4 digit security codes
• GPS coordinates - Latitude/longitude pairs
• API keys - Common API key patterns (20+ characters)
• Bearer tokens - JWT and OAuth tokens

• Article 32: Personal data transmitted without encryption
• Article 6: Location data collected without consent
• Article 13: Missing privacy notice

• §1798.100: Personal information collected
• §1798.140: Unique identifiers collected

• Security Rule: PHI exposure detected
• Security Rule 164.312(e)(1): PHI transmitted without encryption

• Requirement 3.4: Credit card number exposed
• Requirement 3.2: CVV/CVC exposed
• Requirement 4.1: Cardholder data transmitted unencrypted

• Requests Analyzed: Total HTTP responses processed
• PII Found: Total instances of sensitive data detected
• GDPR/CCPA/HIPAA/PCI: Violation counts by regulation
• Color-coded statistics (red background for violations)

• Sortable table with severity, regulation, article, title, and URL
• Double-click to view full details
• Automatic severity-based highlighting in Burp Proxy:
  • Red: CRITICAL violations
  • Orange: HIGH violations
  • Yellow: MEDIUM violations

One-click generation of attorney-ready documentation:

• Executive Summary: Statistics and severity breakdown
• Regulatory Violations: Detailed violation descriptions with fine exposure
• Technical Evidence: Chain of custody with SHA256 hashes
• Damages Calculation: Maximum statutory fine exposure

Each violation includes:

• Timestamp and SHA256 hash for chain of custody
• Full URL and HTTP method
• PII types detected with actual values
• Request/response snippets (first 1KB)
• Regulation, article/section, and severity
• Fine exposure calculation

1. Load extension in Burp
2. Browse target application normally
3. Monitor "Compliance Scanner" tab for violations
4. Select violation to view full details
5. Click "Generate Legal Package" to export evidence
6. Paste into legal documentation or reports

• CRITICAL: Immediate legal risk (e.g., credit cards over HTTP, PHI exposure)
• HIGH: Significant compliance violation (e.g., location data without consent)
• MEDIUM: Disclosure requirement (e.g., PII collection without notice)

• GDPR: EUR 10-20M or 2-4% of annual global turnover
• CCPA: USD 100-750 per consumer per incident
• HIPAA: USD 100-50,000 per violation
• PCI DSS: USD 5,000-100,000 per month of non-compliance

================================================================================
ATTORNEY-READY COMPLIANCE VIOLATION REPORT
================================================================================

EXECUTIVE SUMMARY
--------------------------------------------------------------------------------

Total Requests Analyzed: 247
PII Instances Detected: 18
Total Violations: 5

Violations by Regulation:
  - GDPR: 2
  - CCPA: 1
  - HIPAA: 0
  - PCI DSS: 2

Severity Breakdown:
  - CRITICAL: 3
  - HIGH: 1
  - MEDIUM: 1

================================================================================
REGULATORY VIOLATIONS
================================================================================

VIOLATION #1
--------------------------------------------------------------------------------
Regulation: PCI DSS
Article/Section: 3.4
Severity: CRITICAL
Title: Credit card number exposed
Description: Full credit card number found in response
Fine Exposure: USD 5,000-100,000 per month of non-compliance
URL: https://example.com/api/payment

• Single-file extension: No external dependencies
• Thread-safe: Handles concurrent Burp requests
• Memory efficient: Stores only violation metadata
• Fast pattern matching: Regex-based detection < 100ms per response

• Compiled regex patterns for performance
• Case-insensitive matching
• Context-aware detection (e.g., CVV near "security code")

• SHA256 hashing of request+response
• ISO timestamp format
• Immutable evidence store

• Passive analysis (no network requests)
• Minimal CPU overhead
• Handles 1000+ requests without degradation

• Jython 2.7 syntax (Python 2.7 compatible)
• No external libraries (pure stdlib)
• Response analysis limited to first 1KB for evidence snippets
• No persistent storage (violations cleared on Burp restart)

1. Document scan scope and authorization
2. Export evidence packages immediately
3. Store SHA256 hashes separately for verification
4. Include timestamp and Burp version in reports
5. Consult legal counsel for jurisdiction-specific requirements

1. Run during normal browsing to catch all traffic
2. Review CRITICAL violations first
3. Verify findings manually before reporting
4. Use evidence snippets to locate exact PII instances
5. Cross-reference with Burp Proxy history using color highlighting

1. Test all application workflows
2. Export legal package for each test session
3. Document remediation recommendations
4. Calculate fine exposure for risk assessment
5. Retest after fixes to verify compliance

• Ensure traffic is flowing through Burp Proxy
• Check that responses contain actual PII (not test data)
• Verify extension is loaded (check Extender → Extensions)

• Review "Details" tab for actual PII values
• Some patterns may match non-sensitive data (e.g., CVV matching random 3-digit numbers)
• Use context from request/response to validate findings

• Clear violations periodically using "Clear Violations" button
• Reduce traffic volume by filtering in Burp Proxy
• Disable extension when not needed

• Initial release
• Passive HTTP(S) traffic monitoring
• 9 PII/PHI detection patterns
• GDPR, CCPA, HIPAA, PCI DSS compliance checking
• Real-time dashboard with statistics
• Violations table with severity highlighting
• Legal evidence package generation
• Chain of custody with SHA256 hashes
• Fine exposure calculation
• Color-coded Burp Proxy history
• Cross-platform support (Windows/Linux/macOS)

Developed by Teycir Ben Soltane

MIT License - Free to use for authorized security testing and compliance auditing.

This tool is for authorized security testing and compliance auditing only. Users are responsible for:

• Obtaining proper authorization before testing
• Complying with applicable laws and regulations
• Consulting legal counsel for jurisdiction-specific requirements
• Verifying findings before taking legal action

The author assumes no liability for misuse or unauthorized use of this tool.

Contributions welcome! Areas for improvement:

• Additional PII patterns (IBAN, passport numbers, etc.)
• More regulations (PIPEDA, LGPD, etc.)
• Persistent storage (SQLite)
• Export formats (PDF, JSON, CSV)
• Custom rule engine
• Machine learning for PII detection

For issues, questions, or feature requests:

• GitHub Issues: Report a bug
• Email: contact@teycirbensoltane.tn
• Website: https://teycirbensoltane.tn