Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

GraphQL XML ScanReport?

Zac | Last updated: Nov 12, 2021 05:42PM UTC

I am trialing Enterprise Edition, and looking at https://portswigger.net/burp/documentation/desktop/scanning/reporting-results it seems that Burp has the option to report scan results in both XML and HTML formats. But looking at https://portswigger.net/burp/extensibility/enterprise/graphql-api/ScanReport.html it appears the GraphQL API only has a report_html() query method? Does the GraphQL API only have the ability to fetch scan reports in HTML format, or is XML an option as well?

James, PortSwigger Agent | Last updated: Nov 15, 2021 11:24AM UTC

Hi Zac,

Thanks for getting in touch.

The documentation link which mentions scan reports in XML and HTML, is the section of our documentation for Burp Suite Professional Edition.

For Burp Suite Enterprise, currently only HTML reports are supported. Please see the Enterprise documentation here: https://portswigger.net/burp/documentation/enterprise/working/scan-results/reporting

We do have an existing request in our development backlog to add support for XML reports in Enterprise. I have linked your case to this request and you will be notified if the feature is added in a future release. I am unable to provide an ETA.

If you need anything further please let us know.

Zac | Last updated: Nov 15, 2021 12:21PM UTC

Thanks James, For what it's worth, I would think Enterprise Edition customers are the *most* likely to desire XML reports because they're the customers that would have the resources & funding to wire Burp scans into a CI/CD pipeline, where it would be helpful to have the ability to parse XML documents (using XPath and other tools) so that we could determine whether or not to fail a build if certain security vulnerabilities are found, etc. I know that's not a decision you can help me with, but for whatever PMs end up reading this post, I cannot emphasize enough how big a feature this would be for getting Burp integrated with automated pipelines! Thanks again!

James, PortSwigger Agent | Last updated: Nov 15, 2021 01:13PM UTC

Hi Zac, Thanks for the feedback, I will add this to the development request, we appreciate it. Have a good day!

Kay | Last updated: Dec 09, 2022 07:10PM UTC

Hi, wanted to check if there is any update on the said topic. I saw that it is now possible to export XML reports from burp enterprise GUI but is it possible to obtain the same through GRAPHQL API as well?

James, PortSwigger Agent | Last updated: Dec 12, 2022 10:19AM UTC