Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

BurpSuite Pro REST API

Michael | Last updated: Jun 25, 2021 04:29PM UTC

is it possible to use the GET /SCAN/[task_id] to obtain information on a running "live audit". id like to know details like how many requests it is making currently, how many queued, how many issues found etc. i can see details of scans that have been created through the POST /SCAN endpoint, but cant see how to retrieve details of a "live audit" failing this, is it possible to submit a new URL to an existing scan created using the POST /SCAN endpoint? which i can then query using GET /SCAN to retrieve progress details? I would like to navigate to a resource, and then stay there until all auditing is complete, then move to the next resource.

Michelle, PortSwigger Agent | Last updated: Jun 28, 2021 01:03PM UTC

Thanks for your message. I'm afraid the REST API commands don't include options to add additional URLs to existing scans or the option to start a new live scan. Can you tell us about your scenario and the proposed workflow, please? When you say you want to navigate to a resource and then stay there until it is audited, would you be manually browsing to that resource? If you'd rather discuss this directly, feel free to email support@portswigger.net.

Michael | Last updated: Jun 28, 2021 11:58PM UTC

we use selenium for e2e testing using headless chrome. the application is a large SPA. id like to use the existing selenium e2e tests to 'drive' the application, so i can leave it running unattended for a few days to get audit results - without me having to manually click through all the resources. However the e2e tests very frequently login as one user, do something, logout, and login as a privilaged user and repeat. To avoid vast numbers of 401 errors due to burpsuite making audit requests after the e2e scripts have logged that user out, id like the e2e tests to 'pause' until burp has completed all audit requests for that resource, then move to the next resource and repeat. I know i can give burp the login sequence for our SPA site, but cant see how i can give it "several" logins, and then how on earth would it know which one to use for any past resource it wishes to issue more audit requests for. i realise how drastically this would slow down the audit, but im happy to leave this for a week. the way burp seems to operate it would start very slowly, then as resources it has already audited be navigated too - it would skip those and move on quickly. potentially i could let it run indefinately, so then it would only pick up on new resources, and skip over the past ones. in my case the burp audit behaviour of doing all "phase 1" audits, then 2, then 3 etc works poorly. it is constantly finding "new" resources and therefore never leaving phase 1 (at least, not leaving phase 1 on anything for many hours", by which time all of its phase 2+ audit requests will 401 Unauthorized.

Michelle, PortSwigger Agent | Last updated: Jun 29, 2021 03:10PM UTC

Thanks for taking the time to explain your scenario. I'm afraid this isn't a use case that the REST API is really designed to cover. We are monitoring requests from users who are interested in a feature that would allow them to perform a Selenium-powered crawl and audit, which sounds like it would be useful here. If you're happy for me to add your vote for it we can post back here with updates for you.

Michael | Last updated: Jun 30, 2021 02:55PM UTC

yes please, id be interested in such a feature. perhaps expanded to more than just selenium and include similar tools like Cucumber

Michelle, PortSwigger Agent | Last updated: Jul 01, 2021 11:18AM UTC