Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Scanner unpaused scan of app1 when actively scanning a single page on app2 (SSO)

Jonathan | Last updated: Apr 03, 2016 03:17AM UTC

Here's the environment: - app1.example.com (SSO enabled app #1) - app2-stage.example.com (SSO enabled app #2) Here's the user story: 1.) Tester spiders app1 without SSO auth 2.) Tester does active scan of app1 without SSO auth (it cannot be actively scanned with auth because it would be disruptive) 3.) Tester pauses active scan for app1 (basically done with testing) 4.) Tester spiders app2-stage with SSO auth 5.) Tester does active scan of since page on app2-stage with SSO auth 6.) Burp active scan resumes for app1 with full page scope and inherits SSO auth established from app2-stage. Effectively, burp starts fuzzing app1 with testers credentials and modifies/corrupts stuff it shouldn't and app1 needs to be reverted from backup. 7.) Tester facepalms What I think should have happened instead: - app1 active scan shouldn't have been restarted (it did) - if app1 active scan was to restart, it should have made that visible in the UI (it didn't)

PortSwigger Agent | Last updated: Apr 04, 2016 10:44AM UTC