Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

IScannerCheck consolidateDuplicateIssues for Host Based findings

Wyatt | Last updated: May 28, 2021 03:50PM UTC

Hi PortSwigger Team, I'm writing an extension to make use of the IScannerCheck for an active scan finding. From the description of the consolidateDuplicateIssues method, it appears that this method is run when comparing issues that only have the same url. My finding is based off the host (proto + domain + port is sufficient) and not the url, so I'm looking for recommendations on how to prevent duplicate issues on every path. I'd prefer to use the consolidateDuplicateIssues method, but it doesn't look like it supports the granularity to specify differences. I can store some metadata in the IScannerCheck object to remember hosts that I have already reported on, however there seems to be a TOCTOU race condition that results in duplicate reports if I'm scanning multiple urls on the same host at a time and one of the threads reports earlier than others. Reducing threads to 1 isn't an ideal solution. Is there a better way to prevent duplicates on an issue that impacts a host rather than a url?

Hannah, PortSwigger Agent | Last updated: Jun 02, 2021 03:36PM UTC

Hi The consolidateDuplicateIssues method is only used when multiple issues are found on the same URL, rather than the same host. Have you checked out any other extensions that implement similar functionality, to see how they've done it? An example would be J2EE Scan - it looks like they've created a method to mark scan checks that should only be run once. You can check out the source code for J2EE Scan here: https://github.com/PortSwigger/j2ee-scan All BApp Store extensions have their source code on GitHub here: https://github.com/PortSwigger

Wyatt | Last updated: Jun 08, 2021 08:44PM UTC

Hi Hannah. Thanks for the response. This was helpful. I can see that J2EE Scan uses Java annotations to ensure that certain checks are only run once per host. I'll have to see how this looks in Jython, if not the J2EE Scan repo could work as a template for my check.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.