Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteBurpSqueezer is an open-source Rust command-line tool that takes a Burp Suite XML traffic export and rewrites it as compact, structured Markdown that a person or an LLM can analyze. In the one example its author publishes, a working dump of about 26.7 MB with 323 transactions was reduced to about 35 KB in the tool’s default mode. It prepares captured traffic. It does not send requests, attack a target, or replace manual testing.
Why a raw Burp dump does not work with an LLM
The author’s starting point was simple: a large Burp Suite capture, handed directly to a language model, did not produce useful analysis. A raw export is mostly repetition. Every transaction carries full request and response headers, cookies, repeated bodies, and static assets that have little bearing on how an application’s logic works. Most of the bytes describe the plumbing, while the relationships a tester cares about, such as which response supplies a token for a later request or which parameter flows into a business action, are spread thin across the file.
As an Amazon Associate I earn from qualifying purchases.
The fix the author chose was to shrink the capture before it reaches the model, and to present what remains in a structure that is easy to read.
What BurpSqueezer does
BurpSqueezer works only on traffic you have already captured and exported. It applies statistical and heuristic analysis to filter redundant or low-value transactions and to surface structure, including:
- endpoint relationships, meaning which endpoints tend to be called together or in sequence
- request sequences across a session
- parameter and value propagation, where a value returned by one response reappears in later requests
- data flows through the application
The output is Markdown designed as compact context for review. The original capture is not replaced. It remains the reference for manual verification and for recovering anything the compression dropped.
Where it fits and where it does not
The strongest case is a large API or application with real business logic and many relationships between requests, such as multi-step checkout flows, account and role workflows, or chained token exchanges. Those are the situations where structure carries the meaning and where filtering out repeated noise helps most.
A small, mostly static, or highly repetitive website is a weaker fit. If there are few meaningful relationships between requests, the analysis has little structure to surface, and the reduction mainly removes material you may not have needed in the first place.
Setup and a first run
The project’s repository documents the following steps. Check the repository for current instructions, since releases and commands can change.
- Install the Rust toolchain.
- Clone the BurpSqueezer repository and change into its directory.
- Run
cargo install --path .from that directory. - Verify the installation with
burpsqueezer --help. - Export your Burp Suite traffic as XML. BurpSqueezer takes that file as its only input.
- Run
burpsqueezer solve burp_dump.xml --output analysis.md. This writes the Markdown report toanalysis.md. - Add
--modeto choose how aggressively the capture is reduced (see the next section),--verboseto print per-stage detail, or--quietto suppress progress output.
Choosing a mode
The three modes are not competing products. They are three points on a trade-off between how much material is retained and how small the output becomes. The compression figures below are the project’s own, measured on its example capture, and they are not independent benchmarks.
| Mode | Intended trade-off | Compression reported in the project README |
|---|---|---|
peaceful |
Keeps the most potentially useful information; largest output of the three | 347× |
standard (default) |
Balanced default between retention and size | 745× (the 26.7 MB to about 35 KB example) |
apocalyptic |
Most selective; keeps only the strongest structural signals and may drop information | 1,738× |
Choose peaceful when a missed relationship would be costly, for example on a complex API you will test by hand afterwards. Use standard as the starting point for most large captures. Reserve apocalyptic for cases where the output must be very small and you accept losing material. Because the mode trades retained information for size, the right choice depends on your capture and is not a fixed ranking.
Rank #4
Reading the compression numbers
The headline result, 26.7 MB reduced to about 35 KB, comes from the author’s post and the project README, both dated 2026. The README notes that compression varies with the dataset. A 745× reduction on one capture does not predict the ratio you will see on another, and smaller or more static captures will compress less.
The numbers describe size only. They say nothing about whether the model’s answers are correct or whether every security-relevant signal survived. Judge the output by checking it against the original capture.
Best Value
Limits to plan for
- Heuristic analysis can miss relationships. The project states that results can omit relevant relationships or security signals.
- Compression can remove information. The more aggressive the mode, the greater the risk. Keep the original XML so you can go back to any transaction.
- It is not an autonomous pentesting tool. In the author’s words, it “doesn’t send requests or attack the target.” Manual testing remains necessary.
- Only analyze traffic you are authorized to access. Captures often contain session tokens, personal data, and other secrets, so treat the Markdown output with the same care as the original file.
- Check your LLM provider’s current input limits before uploading. Those limits are set by the provider, not by BurpSqueezer, and they change over time.
- Burp Suite is not included. The project is independent of PortSwigger and does not distribute Burp Suite, so you need your own installation to produce the export. As the project’s README puts it, BurpSqueezer “is an independent security research tool and is not affiliated with, endorsed by, or developed by PortSwigger.”
Where that leaves you
If your problem is a large, relationship-heavy capture that an LLM cannot take in whole, BurpSqueezer is a reasonable preparation step. Start with standard, read the output against the original, and move to peaceful if the reduction removed something you needed. If your captures are small or mostly static, the tool will add little, and reading the traffic directly will be faster.
The 26.7 MB example shows that the reduction can be large. It does not show that the output is complete, which is why the original capture stays in your workflow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
