Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Scope exclude requires include

Slokko | Last updated: Feb 23, 2018 07:18AM UTC

It seems that the In-Scope defining doesn't allow defining scope using only rules that exclude addresses. A way to circumvent this seems to be to make a single include rule for IP-address range 0.0.0.0/0.

PortSwigger Agent | Last updated: Feb 23, 2018 04:30PM UTC

Hi Slokko, Thanks for getting in touch. You're correct, you can only exclude targets if they are already in-scope. This matches the way most people use scope - the scope is configured to match the targets they are authorized to test. I would recommend caution creating a catch all in-scope rule like you suggest as it makes it easier to accidentally active-scan an unauthorized target.

Burp User | Last updated: May 02, 2018 09:02AM UTC