Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Seeking Advice on Configurations for Vulnerability Assessment Scans in BurpSuite Professional

Rashmika | Last updated: Mar 15, 2024 10:33AM UTC

I am currently conducting vulnerability assessment and penetration testing for an OTC platform that facilitates energy import and export. The platform caters to two types of users: 1) Admin and 2) DISCOM, a normal user. I am utilizing BurpSuite Professional for conducting vulnerability assessment scans. While BurpSuite offers various configurations for scans (including built-in and custom configurations), I am seeking expert advice on the best approach for conducting both live passive and live active scans. In the initial phase of vulnerability assessment, I performed a live scan by selecting the pre-configured task 'Passively scan all traffic passing through proxy.' This scan detected several medium and information-related issues, including email addresses disclosed in responses, cacheable HTTPS responses, disclosure of private IP addresses, lack of enforced strict transport security, and frameable responses (potential clickjacking). Could you suggest another configuration that would enable me to detect maximum vulnerabilities effectively?

Hannah, PortSwigger Agent | Last updated: Mar 15, 2024 05:05PM UTC

Hi A passive scan contains checks that do not make any additional requests to your target endpoint. If you're happy for additional requests to be sent, you could enable some more of Burp's native scan checks as part of your live audit. Alternatively, you could run a full scan against the site, providing credentials for your users. This would use a crawl to map out the application, followed by an audit that tests for specific vulnerabilities. An advantage of a full scan over a live audit task is that it is path-aware. It will attempt to start a clean session and navigate to the appropriate page to perform an audit check. This should mean that you are in as close to the same state each time for an audit attack, rather than potentially losing a session and running an audit task against an endpoint you no longer receive a valid response for.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.