Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Automate Burpe with login Credentials

Mallachar | Last updated: Jun 28, 2016 09:47PM UTC

Hello All, I have two different websites I currently manually scan, both of them require me logging in to scan and spider. I was looking to automate my process with Carbonator but it doesn't seem to have a way for me to automate the process with login credentials for the websites. Here are examples of what I need to scan and spider. www.client1.com/product1 - Spider www.client1.com/product2 - Spider www.client1.com/product3 - Spider www.client2.com/product1 - Spider www.client2.com/product2 - Spider www.client2.com/product3 - Spider In total there are two different websites I need to login too, and each one has about 10 product tools that I need to spider/scan. Carbonator seems to lack the functions I need to do this. I am currently using a copy of Burp Suit Pro.  I have also looked at the Burp Extender for the API, but my python skills are minimal and so this seems a little over my head. I am hoping maybe there is a way to get Carbonator to work with this? I also liked that Carbonator output automatically the HTML report, which is another reason I wanted to use it, but hoping maybe another extender can do this?

PortSwigger Agent | Last updated: Jun 29, 2016 08:06AM UTC

Burp doesn't currently support use of multiple credentials in the same scan very well, and Carbonator doesn't either. A possible workaround would be to create different Burp configurations for each user context (using different session handling rules) and then kick off a separate scan (using Carbonator if desired) for each different configuration. Longer term, we are working on making Burp natively support configuration of multiple sets of credentials, and automatic use of these when spidering and scanning. We hope to have progress to report on this within the coming year.

PortSwigger Agent | Last updated: Oct 12, 2018 09:12AM UTC

Burp 2 which is now in beta has greatly improved the handling of application login, and allows you to provide multiple sets of credentials.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.