Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Crawl and Audit do not complete without request timeouts

Jared | Last updated: Dec 01, 2021 10:37PM UTC

Hi, I'm fairly new to burp suite. I have gone through the documentation and for a while was using a passive scan while manually testing my application and this seemed to be doing an ok job of reporting things... I thought. I'm interested in running the automated Crawl and Audit, however, when I start a scan with just my root URL, the crawl never gets past /login. I've included creds both ways possible even though our login is a simple two-field authentication interface. If I provide my base URL and one link length deeper, the crawl jumps up some, but all of the audits error out with a timeout request. At this point, I can't get the crawl/audit to work for me and I'm not sure where to get help other than here. I have the link depth set to 5, and crawl and audit modes set to most complete. Our application is all javascript, and I have the embedded browser set to "Yes" for the crawl. I have watched the crawl by enabling the headed mode and can verify it never goes past the login page. Running Pro Version v2021.10.2 Any help is appreciated. -Jared

Ben, PortSwigger Agent | Last updated: Dec 02, 2021 10:50AM UTC

Hi Jared, Just to clarify, have you just used the login credentials method of authenticating against the site or have you also tried to use a recorded login?

Jared | Last updated: Dec 02, 2021 02:50PM UTC

Hello, I've tried both methods and neither one seems to be getting past the login screen. When I watched the headed browser crawl, it looked like entries were being entered into the user and pass fields... SO i'm not sure what the issue is.

Ben, PortSwigger Agent | Last updated: Dec 02, 2021 07:12PM UTC

Hi Jared, You can actually test a recorded login in Burp Professional independently of running a scan. This is normally useful in order to determine whether the sequence that you have recorded has accurately captured the authentication steps (without the need to run a full blown scan). There is some information on how to test recorded logins below - are you able to test your sequence and confirm whether the replay works as expected: https://portswigger.net/burp/documentation/desktop/scanning/recorded-logins#how-to-test-a-recorded-login-sequence In addition to the above, Is the site that you are testing publicly available and one that we could take a look at ourselves?

Jared | Last updated: Dec 03, 2021 05:07PM UTC

OK, I was able to verify that the login is now working. However, the audit details still only show /login. Is there some other reason, the crawler may not be discovering things correctly in our web app? Also, I'm still getting timeout errors even on the things it did discover (I can send a screenshot if you give me an email to send it to). The site is public-facing, but I would need to get permission in order to give you a login. https://nl-qa-00.ecr.software/ Is it possible to maybe set up a time where we can look at it together, over zoom? -Jared

Ben, PortSwigger Agent | Last updated: Dec 06, 2021 01:30PM UTC