Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Server down check

Andrej | Last updated: Mar 20, 2017 01:18PM UTC

It would be very good to have some sort of keep-alive functionality to ping server whether it is still up, and depending on the pre-set response by user (e.g. custom error message), it would pause Active scanning until the ping is a success, or user starts it again after making sure the environment is working. On a "volatile" environment, the Active scanner scans until it is finished, ignoring the state of the server (if some specific error page is set to all requests). I know that as a part of session management session checking can be done, I'm not aware of a possibility to stop/pause active scanner in case of server-side issues (ideally a user pre-defined).

PortSwigger Agent | Last updated: Mar 21, 2017 04:02PM UTC

Thanks for this suggestion. We're planning to provide more capabilities in terms of fully automated crawl-and-scan, and as part of this we will consider ways that we can suspend / throttle the scan in situations where the target application is volatile.

Burp User | Last updated: Apr 25, 2017 08:03AM UTC

Thank you, that's very helpful to know. In the mean time - is there some API or way to create Extender, which would have the power to pause the Active scan? If not, could something be added in future to be able to control active scanner state via extenders? Many thanks:)

PortSwigger Agent | Last updated: Apr 25, 2017 10:22AM UTC

There isn't currently an API to pause/unpause the Scanner, sorry. We are planning a general revamp of the API and we will look into providing this. In the meantime, a nasty hack to implement your own pause function would be to use an IHttpListener to hook all requests made by the Scanner, and wait each thread on your own lock object when you want the Scanner to be paused.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.