Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

When I use Burp Suite Enterprise Edition to scan OWASP Benchmark, the tool cannot audit any vulnerabilities.

Andrew | Last updated: Dec 01, 2022 06:35AM UTC

Hi, When I use Burp Suite Enterprise Edition to scan OWASP Benchmark (https://x.x.x.x:8443/benchmark/), the tool can crawl all web pages but cannot audit any vulnerabilities.But when I use the URL(https://x.x.x.x:8443/benchmark/cmdi-Index.html) as site, the tool seems to be working and can audit some vulnerabilities. Burp Suite Pro has the same question. have you seen this before? Is there any solution? https://github.com/OWASP-Benchmark/BenchmarkJava/releases/tag/1.2beta

Maia, PortSwigger Agent | Last updated: Dec 01, 2022 11:01AM UTC

Thank you for your message. Would you be able to email support (support@portswigger.net) with a copy of the following logs from Burp Suite Enterprise Edition so we can investigate further please? - The scan event logs for both scans. This can be found on the logging tab of the scans under Event log - The scan debug logs for both scans. This can be found on the logging tab of the scans under Scan debug log - A screenshot of the Setting tab for both scans - A screenshot of the Diagnostics page. This can be found under the help menu or by navigating to [EnterpriseServer]/help/support

Andrew | Last updated: Dec 02, 2022 02:07AM UTC

Hi，Maia My trial license has expired. I will try to export it out if I have a few more days of license. Do you have environment to scan OWASP Benchmark? Is it normal when scanning? Best regards,

Maia, PortSwigger Agent | Last updated: Dec 02, 2022 04:19PM UTC

Hi Andrew, It looks like the /benchmark/cmdi-Index.html page is not being found when starting the crawl from /benchmark. Running the scan using the verbose logging option will show how the pages are being crawled and may help troubleshoot further. The verbose log will replace the scan debug log, which can be found under the Logging tab of the scan. As a workaround, you can add the /benchmark/cmdi-Index.html page as an included URL. You can do this by editing the site, then clicking on the Additional/Excluded URLs dropdown under the Site scope. Add the URL to the Included URLs section and then scroll down and click Save to save the changes. https://portswigger.net/burp/documentation/enterprise/working-with-sites/edit-existing-sites Please email us using the account your license is associated with, and we will see what we can do about extending your trial license :)

Andrew | Last updated: Dec 05, 2022 09:29AM UTC

Hi, Maia The "Scan debug log" is too large too retrieve in Burp Suite Enterprise. "/benchmark/cmdi-Index.html" is a "Command Injection Test Case Index", the index page contains command injection vulnerability test cases such as "/benchmark/BenchmarkTest00006.html". The "/benchmark/BenchmarkTest00006.html" can be found when crawling from "/benchmark" both in Burp Suite Enterprise & Pro, but the tools cannot audit the vulnerability contained in the html page. According to "Aduit items" on Burp Suite Pro, the tool only sent one request to "/benchmark/BenchmarkTest00006.html", and did not use the submit button on the page, so no command injection vulnerability was found. Has anyone else scanned OWASP Benchmark? Do they have similar issues? Best regards,

Maia, PortSwigger Agent | Last updated: Dec 06, 2022 11:40AM UTC

Our scanner team has suggested that the older version of the crawler (Burp Spider) worked best against this type of app. In modern Burp, the "Fastest" crawl strategy scan configuration should closely replicate this crawl style. Have you tried using different scan configurations with the site? Can you try using the "Crawl strategy - fastest" scan configuration?

Andrew | Last updated: Dec 07, 2022 03:40AM UTC

Hi, Maia I've tried almost all configuration on Burp Suite Enterprise, but none of them can scan OWASP Benchmark(https://x.x.x.x:8443/benchmark/) for any valid vulnerabilities. In addition, shouldn't this be related to the AUDIT function? Why need to adjust the configuration of CRAWL? Thanks,

Maia, PortSwigger Agent | Last updated: Dec 07, 2022 11:36AM UTC