Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

IScannerCheck consolidateDuplicateIssues for Host Based findings

Wyatt | Last updated: May 28, 2021 03:50PM UTC

Hi PortSwigger Team, I'm writing an extension to make use of the IScannerCheck for an active scan finding. From the description of the consolidateDuplicateIssues method, it appears that this method is run when comparing issues that only have the same url. My finding is based off the host (proto + domain + port is sufficient) and not the url, so I'm looking for recommendations on how to prevent duplicate issues on every path. I'd prefer to use the consolidateDuplicateIssues method, but it doesn't look like it supports the granularity to specify differences. I can store some metadata in the IScannerCheck object to remember hosts that I have already reported on, however there seems to be a TOCTOU race condition that results in duplicate reports if I'm scanning multiple urls on the same host at a time and one of the threads reports earlier than others. Reducing threads to 1 isn't an ideal solution. Is there a better way to prevent duplicates on an issue that impacts a host rather than a url?

Hannah, PortSwigger Agent | Last updated: Jun 02, 2021 03:36PM UTC

Hi The consolidateDuplicateIssues method is only used when multiple issues are found on the same URL, rather than the same host. Have you checked out any other extensions that implement similar functionality, to see how they've done it? An example would be J2EE Scan - it looks like they've created a method to mark scan checks that should only be run once. You can check out the source code for J2EE Scan here: https://github.com/PortSwigger/j2ee-scan All BApp Store extensions have their source code on GitHub here: https://github.com/PortSwigger

Wyatt | Last updated: Jun 08, 2021 08:44PM UTC