Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

Burp Extension/API DOM Checks

Ryan | Last updated: May 24, 2023 04:39PM UTC

When Burp performs DOM-based scanning, is it possible to utilize the API to extend the scanning to identify custom issues? For example, looking for the presence of certain content in the built DOM?

Hannah, PortSwigger Agent | Last updated: May 26, 2023 12:27PM UTC

Hi Are you referring to adding additional scan checks? If so, you can find an example of an extension that provides an additional scan check here: https://github.com/PortSwigger/burp-extensions-montoya-api-examples/tree/main/customscanchecks Our Montoya API documentation can be found here: https://portswigger.net/burp/documentation/desktop/extensions/creating

Ryan | Last updated: Jul 13, 2023 02:59PM UTC

Hi Hannah, thank you for the response, but I will have to clarify. My understanding is that Burp's scanner uses the built-in browser to render the DOM and perform DOM-level actions as part of the scan. I am curious if it would be possible to interact with this browser component using the API to access elements of the DOM during a scan.

Hannah, PortSwigger Agent | Last updated: Jul 17, 2023 01:12PM UTC

Hi. Thanks for that clarification! Unfortunately, it is not possible to do this with the Montoya API. However, there are some different methods you could use. You could make use of the DOM Invader browser extension and a tool called Puppeteer. You would use Puppeteer to load the pages you want to test, then use callbacks within the DOM Invader browser extension to log information to a location. Further information on using callbacks in DOM Invader can be found here: - https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/misc#configuring-callbacks - https://portswigger.net/blog/finding-client-side-prototype-pollution-with-dom-invader

You need to Log in to post a reply. Or register here, for free.