Interactive JSON explorer with click-to-path navigation and embedded
jqengine for Burp Suite.
JQ Navigator is a Burp Suite extension that helps security analysts and pentesters work with complex JSON responses using real-time jq queries — no external binary required.
Instead of scrolling through walls of raw JSON, you click on any node in the visual tree and the exact jq path is auto-generated for you. Run queries, extract secrets, filter arrays, and save templates — all without leaving Burp.
| Suite Tab — Visual Tree + Filter | Click-to-Path Context Menu |
|---|---|
 |
 |
| Multiples items | History & Saved Templates |
|---|---|
 |
 |
| # | Feature | Description |
|---|---|---|
| 1 | Visual Click-to-Path | JSON responses are rendered as a collapsible JTree. Click any node to auto-generate the exact jq path (e.g. .data.users[2].profile.email) in the filter bar. Right-click for additional options: insert with concrete index, generalize to [], or copy to clipboard. |
| 2 | Embedded jq Engine |
Powered by jackson-jq (pure Java). No need to install the jq binary on your system. Works on any OS. |
| 3 | Suite-wide Collector Tab | A top-level JQ Explorer tab in Burp. Send any request/response from HTTP History, Repeater, or Target via the native context menu → Send to JQ Explorer. Organize them in folders for structured analysis. |
| 4 | In-message Tab | Adds a JQ Navigator sub-tab directly inside Proxy and Repeater response viewers for quick filtering without switching tools. |
| 5 | History & Templates | Access recently executed queries and save your own reusable templates (⭐ Save template...). Double-click any history entry to re-apply it instantly. |
| 6 | Multiple Output Formats | Switch output between Pretty JSON, Compact JSON, CSV, or Plain Text from the format selector. |
| 7 | Background Processing | All jq execution runs on background threads to keep Burp's UI responsive, even with large JSON payloads. Memory is optimized via .copyToTempFile() for gigantic responses. |
| 8 | Manual JSON Input | Paste JSON from external sources (logs, APIs, clipboard) directly into the tool for analysis — no HTTP request needed. |
In any Burp tab (HTTP History, Repeater, Target), right-click a request and select Send to JQ Explorer. The request appears in the left sidebar of the JQ Explorer tab. Create folders to organize your analysis sessions.
Select an entry from the list. The interactive JSON tree appears in the lower-right panel. Click any node to auto-fill the jq filter bar. Press Enter or click Apply to see the filtered result with syntax highlighting.
Right-click on a tree node for extra options:
- Insert path with concrete index — uses the exact position (e.g.
.pages[0].id) - Insert path generalizing array to [] — iterates all elements (e.g.
.pages[].id) - Copy path to clipboard
- Click the history button (⚙️) to see recently used filters and saved templates.
- Click ? to open the built-in help and
jqquick reference cheatsheet.
No need to send to the Suite Tab for quick checks. The JQ Navigator sub-tab is available directly in Proxy and Repeater response panels.
These are real scenarios where JQ Navigator saves time during a pentest:
| Scenario | jq Filter |
|---|---|
| Extract all emails from a response | .. | strings | select(test("@")) |
| Get all user IDs from an array | .users[] | .id |
| Hunt for secrets — find fields with token/secret/key/pass | .. | objects | to_entries[] | select(.key | test("token|secret|key|pass"; "i")) | {(.key): .value} |
| Count elements in an array (e.g. products) | .products | length |
| Filter only admin users | .users[] | select(.role == "admin") |
| List all root-level keys | keys |
| Extract all URLs from a response | .. | strings | select(startswith("http")) |
| Project specific fields from a list | .data[] | {id, email, role} |
| Detect objects with null token | .[] | select(.token == null) |
| Sort results by field descending | .orders | sort_by(.created_at) | reverse |
- Java: JDK 17 or later
- Burp Suite: Any edition compatible with Montoya API (2023.12+)
Grab the latest pre-built JAR from the Releases page — no build step required.
The project uses Gradle and produces a self-contained Fat JAR (includes jackson-jq and jackson-databind):
./gradlew fatJarIf you have shell restrictions, use:
java -cp gradle/wrapper/gradle-wrapper.jar org.gradle.wrapper.GradleWrapperMain fatJar
The output JAR will be at:
build/libs/jq-navigator-1.0.0.jar
- Open Burp Suite.
- Go to Extensions → Installed.
- Click Add.
- Set Extension type to
Java. - Select the generated JAR file and click Next.
The JQ Explorer tab will appear in Burp's top navigation bar.
| Library | Version | License |
|---|---|---|
| jackson-jq | 1.0.0 | Apache 2.0 |
| jackson-databind | 2.15.x | Apache 2.0 |
| Burp Suite Montoya API | — | PortSwigger |
This project is licensed under the GNU Affero General Public License v3.0. See LICENSE for details.