🎯 VISTA Documentation
Vulnerability Insight & Strategic Test Assistant — AI-Powered Security Testing for Burp Suite.
What is VISTA?
VISTA is a professional Burp Suite extension that enhances security testing with AI-powered intelligence. It combines real-time traffic analysis, interactive AI guidance, and practical pentesting tools to help you test faster, smarter, and more systematically.
Version: 2.10.28 · License: MIT · Java: 17+ · Size: ~1.3MB · Zero Dependencies
New in v2.10.28: Azure AI Foundry support (new endpoint format), Azure Identity (DefaultAzureCredential) auth, configurable API version, status bar shows correct model name per provider,
+ New Chatproperly creates a new session,max_completion_tokensfor all providers, reasoning model temperature fix (o1/o3/o4), errors now surface correctly from OpenAI.
✨ Key Capabilities
| Feature | Description |
|---|---|
| 🌐 Traffic Monitor | Real-time HTTP traffic analysis with AI-driven vulnerability detection |
| 🤖 AI Advisor | Context-aware interactive testing suggestions with conversation history |
| 📝 12 Expert Templates | Built-in prompt templates covering the most common bug bounty vulnerabilities |
| 🎯 80+ Payloads | Pre-built payloads across 8 categories with AI-powered suggestions |
| 🛡️ WAF Detection | Detect and bypass 8 major WAFs with 250+ bypass techniques |
| 🆓 Free AI | Use OpenRouter with no credit card — powerful AI at zero cost |
🚀 Quick Navigation
Getting Started
- Installation — Download, build, and install VISTA
- Quick Start — Configure AI and start testing in 5 minutes
- Free AI Setup — Use VISTA completely free with OpenRouter
Core Features
- Traffic Monitor — Passive AI traffic analysis
- AI Advisor — Interactive testing assistant
- Payload Library — Manage and deploy payloads
- WAF Detection — Identify and bypass WAFs
Templates
- Template Overview — How the template system works
- Built-in Templates — All 12 expert templates
- Custom Templates — Create your own templates
Configuration
- AI Providers — Configure OpenAI, Azure, or OpenRouter
- Scope Management — Target scope configuration
- Data & Backup — Data storage, backup, and restore
Reference
- Architecture — How VISTA works under the hood
- Contributing — Contribute to VISTA
🎯 Supported Vulnerabilities
| Vulnerability | AI Guidance | Payloads | Expert Template | Bypass Techniques |
|---|---|---|---|---|
| Cross-Site Scripting (XSS) | ✅ | ✅ | ✅ DOM + Reflected | ✅ |
| SQL Injection | ✅ | ✅ | ✅ | ✅ |
| Server-Side Template Injection | ✅ | ✅ | ✅ | ✅ |
| Server-Side Request Forgery | ✅ | ✅ | ✅ | ✅ |
| IDOR / BOLA | ✅ | — | ✅ | ✅ |
| Authentication Bypass | ✅ | — | ✅ | ✅ |
| File Upload | ✅ | — | ✅ | ✅ |
| Race Conditions | ✅ | — | ✅ | — |
| JWT / OAuth | ✅ | — | ✅ | ✅ |
| API Security (OWASP Top 10) | ✅ | — | ✅ | ✅ |
| Command Injection | ✅ | ✅ | — | ✅ |
| XXE | ✅ | ✅ | — | ✅ |
VISTA is designed for authorized security testing only. Always obtain proper authorization before testing any target.