Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Different results posted by Burp Suite Pro versus Enterprise

Cyril | Last updated: May 14, 2020 12:48PM UTC

Hi, I ran web tests using a Burp Suite Pro license (temp). As I ran similar tests on the same target using the same settings on a Burp Suite Enterprise tool (which my company bought), I discover I have slightly different results than that of Pro. Why is this so? Particularly, Pro is able to return a XPath vulnerability labeled as High severity and Firm but went undetected by the Enterprise tool. The settings I use include 1. Crawl strategy - most complete 2. Audit coverage - thorough 3. Never stop audit due to application errors 4. Never stop crawl due to application errors 5. Minimize false positives I ran the tests several times and they are very consistent. I am puzzled as to which I should believe.

Michelle, PortSwigger Agent | Last updated: May 14, 2020 02:27PM UTC

Both products are using the same Burp Scanner. When you ran the scan in Pro were you using a new project file? If you compare the URLs scanned in Professional (Task Details -> Audit Items) with the URLs Scanned in Enterprise are they the same? Is there any authentication on the site? If you're happy to share the scan configurations you used and the resulting reports/report differences with us via email, you can send them over to support@portswigger.net and we can take a closer look with you.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.