Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Professional and Burp Enterprise Reports Issue

sania | Last updated: Mar 11, 2020 09:53AM UTC

Hi Team, I am scanning a application in Burp Enterprise Version: 2020.2-3025 and Burp Professional Version v2020. As per my observation Burp Pro is showing more number issues and Burp ENT pro is showing very less number of issue. Burp PRO ISSUE: Burp Professional Version v2020 Scan Time: 2m 1.Cookie scoped to parent domain 2. Password field with autocomplete enabled 3. Long redirection response 4.Input returned in response (reflected) 5.TLS cookie without secure flag set 6. Email addresses disclosed 7. TLS certificate Burp ENT Issue: Scan Time: 1m 24s 1.Input returned in response (reflected) 2.TLS certificate Could you please let me know the root cause for it and why ENT is showing is less vulnerability. As I am using the same PRO configuration JSON file in ENT to get the same report. Regards, Sania

Michelle, PortSwigger Agent | Last updated: Mar 11, 2020 11:52AM UTC

Hi The first thing to make sure that Burp Professional and Burp Enterprise have found the same URLs when the scan has completed, e.g. if the site requires a login and Burp Enterprise fails to login but Burp Professional can the Professional may find more pages and so find more vulnerabilities. It is also possible that the report from Burp Professional is including results found earlier during the lifetime of the project file. Good ways to test this are: - Create a new project in Burp Professional and re-run the scan, make a note of the URLs listed in the Audit Items tab of the scan task - Run the scan in Enterprise and make a note of the Scanned URLs listed at the end of the scan - Compare the URLs from the Audit Items in Professional and the Scanned URLs in Enterprise and see if they are the same. If they are not, then identify the differences so you can try and work out why URLs would not be found (e.g. do they require a specific type of login?) If you want us to take a closer look at the results and the setup of the two scans then you can always send us screenshots via email to support@portswigger.net

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.