Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Reduced parameters to be checked in Scanner

Ander | Last updated: Dec 19, 2016 01:25PM UTC

I'm trying to write an extension of BURP to reduce the number of checks to be done while performing and Active/Passive scan. Our tool already provides integrity validation for links and non-editable data, so my idea was to create an extension so that the number of checks performed by BURP is reduced not to include those. I'm reviewing the API for extension but I cannot figure out if this is even possible. Could you help me on that? Thanks in advance

PortSwigger Agent | Last updated: Dec 19, 2016 01:45PM UTC

You can configure which scan checks are enabled (or indeed any other project level setting), via the API: https://portswigger.net/burp/extender/api/burp/IBurpExtenderCallbacks.html#loadConfigFromJson(java.lang.String) Just create the config you want in the UI, save the config for the relevant panel(s) as JSON, and load the config as a string via the above API.

Burp User | Last updated: Dec 19, 2016 05:02PM UTC

Thanks for the response, it looks like a good starting point, After reviewing scanner configuration I have some additional questions: a) Parameter Name: I guess this option means including a random new parameter right? b) URL path filename: I don't completely understand which is the purpose of this insertion point, is it changing directly the request path? If I'm right with their meaning I think that both of them should be disabled while testing Hdiv protected websites. But now it comes the complicated part, our framework protects parameters inside links and data that is not editable (selects, radios..) 1) My first thought was to disable "URL Parameters values" but those parameters could be received in case of links but also in GET Forms, is there any way to distinguish between them? 2) For each particular form there will be editable and non-editable parameters is there any way to handle that? I could have used "Skip all tests for these parameters" but I would need the URL in the configuration. Is there anything to help me on that?

PortSwigger Agent | Last updated: Dec 19, 2016 05:05PM UTC