Burp Suite User Forum

Login to post

Modify Content Discovery task queue

Isaac | Last updated: Jul 17, 2020 10:12PM UTC

Current behavior: Content discovery session configuration, specifically task queue, is static after session start. It updates dynamically according to discovered content, with no option to remove items from queue. Desired behavior: Ability to remove items from queue while session is running.

Liam, PortSwigger Agent | Last updated: Jul 20, 2020 02:19PM UTC

Thanks for your message. To help us properly record this request, could you provide a use case for this feature?

Isaac | Last updated: Jul 22, 2020 12:20AM UTC

Initial content discovery/enumeration necessarily involves not knowing what content is on the target webserver. As such, it is difficult to provide a configuration at the outset that achieves optimal thoroughness without having overly long-running discovery sessions. Oftentimes there are directories that are discovered (and are added to the task queue) that are unlikely to contain relevant content. For example, running content discovery on http://host.com/ may find http://host.com/css http://host.com/js http://host.com/img etc. On an initial scan, I dont usually care to fully search these common directories. To my knowledge there is not even a way to exclude directories from consideration. This leads to a chain of subsequent tasks that are equally irrelevant (e.g. all combinations of: /imgs/{directory}/{filename}.{extension}, /js/{directory}/{filename}.{extension} /css/{directory}/{filename}.{extension} The problem compounds with each additional level of Max Depth setting. So, in the event that these were discovered, I would like to be able to manually remove them from the queue, thereby shortening the duration of my discovery session. Sort of human-in-the-loop automation. Happy to provide more input if it's still not clear.

Michelle, PortSwigger Agent | Last updated: Jul 23, 2020 08:17AM UTC

Thanks for the explanation of your use case. This is currently not on our roadmap or backlog, but we’re keeping a record of it to see if there is further demand. We prioritize our ideas based on value to all of our customers. If the demand grows it will be added to our roadmap or our backlog of small improvements. In the meantime c=would the option to provide a custom directory list instead of using the built-in ones help you at all in this situation?

You need to Log in to post a reply. Or register here, for free.