Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

spider for http basic auth w/o TLS

Robert | Last updated: Aug 21, 2018 03:00PM UTC

Hello all, http basic auth used in the clear (without TLS) is considered a security violation in my organization. We have a large number of web servers some with very deep levels of pages, so looking for this by hand is tedious. I am looking for a tool to find such security violations. Does something already exist? Or do I need to write one myself? If the latter, any hints or suggestions on doing this with Burp Suite would be appreciated. Thank you, R. Keyes

PortSwigger Agent | Last updated: Aug 22, 2018 08:45AM UTC

This is detected by Burp Scanner; the issue raise is "Cleartext submission of password". There's some information about that here: - https://portswigger.net/kb/issues/00300100_cleartext-submission-of-password

PortSwigger Agent | Last updated: Aug 22, 2018 01:38PM UTC

Just to add to that: you need to Spider the application, but you don't need to perform an active scan. It is sufficient to perform a passive scan, which is much faster. I recommend you change the site map filter to "Show all", Spider the application, the right-click the top-level entry and choose "Passively scan this host".

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.