Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Montoya API Documentation is not inline with the Montoya test extension

Adrian | Last updated: Dec 22, 2023 09:44AM UTC

Dear all, I am looking to the Montoya test extension from here: https://raw.githubusercontent.com/PortSwigger/burp-extensions-montoya-api/d86f875647ae35ad3647afbc13090f59c5120c8e/api/src/test/java/burp/api/montoya/TestExtension.java In the example the way to trigger a passive scan is something like: Scan scan = scanner.createScan(); scan.addRequestResponse(httpRequestResponse); scan.addConfiguration(PASSIVE_AUDIT_CHECKS); Audit audit = scan.startAudit(); The scanner is an implemetnation of burp.api.montoya.scanner.Scanner Now, looking to the Scanner JavaDoc (https://portswigger.github.io/burp-extensions-montoya-api/javadoc/burp/api/montoya/scanner/Scanner.html) I see no "createScan" method ans no Scan class or interface either. The question is how do trigger a passive or an active scanner from the Montoya API. thx, Adrian

Michelle, PortSwigger Agent | Last updated: Dec 22, 2023 12:04PM UTC

Hi I've just been trying to find that specific example. It's possible you may be looking at an old version. The current examples can be found here: https://github.com/PortSwigger/burp-extensions-montoya-api-examples The options for customizing a scan are limited. The following would achieve the same as right-clicking and choosing 'Do active scan' and would audit one item: Scan scan = api.scanner().createScan(); scan.addRequest(HttpRequest.httpRequestFromUrl("https://ginandjuice.shop/catalog/product/stock")); scan.addConfiguration(BuiltInScanConfiguration.ACTIVE_AUDIT_CHECKS); scan.startAudit(); I hope this helps as a starting point.

Adrian | Last updated: Dec 22, 2023 01:31PM UTC

Michel, Thank you for the resposne. It does not really help. In the Scanner interface there is no "createScan" method; see https://portswigger.github.io/burp-extensions-montoya-api/javadoc/burp/api/montoya/scanner/Scanner.html How can create a Scan using the Montoya API ? There is not even a Scan class in the official API. And BTW the code example is straight from the official documentation: https://portswigger.net/burp/documentation/desktop/extensions

Michelle, PortSwigger Agent | Last updated: Dec 22, 2023 01:43PM UTC