Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

[Enterprise] Avoiding requests to external resources

JAVIER | Last updated: Jul 13, 2023 11:32AM UTC

Hi, We need to avoid BE's scanner to send requests to certain URLs, such as Google APIs included in scripts or hrefs To clarify, we are talking about a site https://example.com which has some references to, let's say, https://maps.googleapis.com/maps/api/js, and we want to avoid loading https://maps.googleapis.com/maps/api/js every time a page in example.com is loaded. Is it possible to accomplish this using the "out of scope URL prefixes" field of a site's configuration? Or that only excludes those URLs from active scans, but allows page loads? Is there any way to do this, besides adding some entries to /etc/hosts so agent's cannot reach the undesired URLs? Kind regards, Javi

Thomas, PortSwigger Agent | Last updated: Jul 13, 2023 01:35PM UTC

Hi Javi, Thank you for your questions on scoping rules. URLs like "https://maps.googleapis.com/maps/api/js" are implicitly out-of-scope when scanning "https://example.com" and declaring it out of scope will not change this behavior. We do not crawl or audit these out-of-scope URLs, but they may be used to fetch the required resources and data for loading a page. You can disable this behavior in a scan configuration under Crawling > Miscellaneous > "Fetch required resources and data from out-of-scope hosts" Disabling this could cause issues for some web applications as these resources can be required to load pages correctly. If this is the case, and this option is disabled, we will require the relevant resources to be declared as in-scope to load the pages. Please note that if declared in-scope, they will be crawled and audited. Please ensure you have permission to crawl and audit everything considered in-scope.

JAVIER | Last updated: Jul 13, 2023 02:00PM UTC