Courier for Burp Suite

Overview of Courier and its Control, Planner, and Webflows tabs

Overview

Courier is a Burp Suite extension that connects Burp to the Praetorian Guard platform. It can synchronize authorized testing data with Guard, attach Burp evidence to Guard Planner conversations, and record browser workflows for later use in authorized testing.

Courier adds a Courier suite tab to Burp. Within that suite tab, the interface is organized into three primary tabs:

  • Control — Connect Courier to Guard, choose the project and target application, configure capture settings, and review activity.

  • Planner — Queue Burp requests, inspect their request and response data, and attach selected evidence to conversations with Guard.

  • Webflows — Record browser workflows, review captured steps, and synchronize completed .courier recordings with Guard.

Before You Begin

To use Courier, you need:

  • Burp Suite Community or Professional

  • The Courier extension JAR from the Courier GitHub releases

  • An active Guard subscription

  • A Guard API key ID and API key secret

  • Authorization to collect and synchronize data for the project and target application you enter

Create Guard API credentials by following Authentication to Guard. Copy the API key ID and secret when they are shown; the secret is displayed only once.

Install Courier

  1. Download the Courier JAR for your operating system from the GitHub release.

  2. In Burp, open Extensions → Installed.

  3. Click Add.

  4. Choose Java as the extension type.

  5. Select the downloaded Courier JAR.

  6. Confirm that the Courier suite tab appears.

Understand the Courier Header

The header remains visible while you move between Courier tabs. It shows:

  • The Courier identity and connection to Praetorian

  • The build identifier

  • The current Guard connection state

  • An About button with product, licensing, repository, and build information

Typical Workflow

  1. Open the Control tab and enter your Guard credentials and testing context.

  2. Review the data-upload disclosure and connect Courier.

  3. Browse and test the authorized application in Burp.

  4. Use the Planner tab to discuss selected Burp evidence with Guard.

  5. Use the Webflows tab when you need to record a repeatable browser workflow.

  6. Return to Control and disconnect Courier when synchronization is no longer needed.

Sensitive Data

Courier is designed for authorized security testing and can collect highly sensitive information. Depending on your activity, synchronized data and webflow recordings can contain credentials, session tokens, cookies, authorization headers, request and response bodies, personal data, and other secrets.

Before connecting Courier:

  • Confirm that the project and target are authorized for testing.

  • Configure Burp's target scope and Courier's excluded extensions appropriately.

  • Use dedicated testing credentials where possible.

  • Decide whether ML-based training should remain enabled for the captured data.

  • Review logs and .courier recordings before sharing them.

Courier stores some output locally. Local Courier files are not encrypted and should be handled as sensitive testing data.