Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Does Burp Enterprise Supports Vaults like hashicorp for DB connection string?

Wayne | Last updated: Jul 08, 2024 07:41AM UTC

Hi Team, does burp enterprise supports storage of DB connection string (credentials) in vault? Currently it stores in plain text for Linux installation.

Maia, PortSwigger Agent | Last updated: Jul 08, 2024 04:42PM UTC

Thank you for your message. Burp Suite Enterprise Edition does not natively support storing database details in a vault. However, it does check for the following environment variables for the database URL and credentials, and if found, they will override the values in the enterprise server config file: BSEE_ADMIN_REPOSITORY_URL BSEE_ADMIN_REPOSITORY_USERNAME BSEE_ADMIN_REPOSITORY_PASSWORD BSEE_AGENT_REPOSITORY_URL BSEE_AGENT_REPOSITORY_USERNAME BSEE_AGENT_REPOSITORY_PASSWORD In theory, if you configure the Hashicorp Vault agent to present the database connection string to the enterprise server service as the BSEE_ADMIN_REPOSITORY_URL and BSEE_AGENT_REPOSITORY_URL environment variables, it should work. You can then either remove the admin_repository and agent_repository sections of the enterprise-server.conf file or replace them with dummy data. If Burp Suite Enterprise Edition fails to read the environment variables provided, then your installation will likely end up in setup mode instead. Please note that we have not tested this configuration, and it is not a supported configuration for a standard self-hosted installation. Please let me know if you have any questions.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.