Improve automated and semi-automated active scanning in Burp Pro

Pentagrid AG

Last update: Dec 13, 2022

Overview

PentagridScanController

Improve automated and semi-automated active scanning for BurpSuite

Author: Tobias "floyd" Ospelt, @floyd_ch, http://www.floyd.ch

Pentagrid AG, 5#, https://www.pentagrid.ch

Improve Automated and Semi-Automated Active Scanning

Active Scanning might often do things that don't make much sense, such as scanning GET requests to static .js files or scanning non-repeatable requests. This extension allows to filter and preprocess according to your needs. It tries to check if a request is repeatable or not. If a request is not repeatable, it tries to make them repeatable by injecting Hackvertor tags. The extension doesn't try to be perfect, but useful. It cuts corners and in some cases simply doesn't scan certain requests. However, the extension individually displays and explains all decisions, allowing you to change the settings if you don't like the behavior. It's a better "Actively scan all in-scope traffic through Proxy".

Requirements

This extension uses Hackvertor tags. Make sure Hackvertor is installed and active.

Compiling

gradle clean build jar

Howto use this extension

Usage is very simple:

Add the website you test to the scope
Enable "Proxy requests" in the tab/section "Scan - Options - Requests to process"
Browse the web application (proxy) by using the Burp builtin browser.
Check back on the $tabName tab and see which request have been active scanned. Check those that have a high "Interesting" rating but haven't been scanned ("Scanned" column set to false)
See the Dashboard for Active Scan findings
It's always good to sort by the reason column in the UI and check the different reasons.

Performance discussion

Improves performance by not sending everything to active scan.

Ideas for future improvements

Let me know if you think of any other improvements in the issues tab.

A program to flip every private, protected and package-private access flag to public in an Android dex file!

DexExposed A program to flip every private, protected and package-private access flag to public in an Android dex file! Building Simply run gradle mak

2 Aug 29, 2021

A simple android app that parses its own signature and displays it

SigDisplayer Usage Download the release APK or clone the repository and compile yourself. Sign the APK with your preferred keystore. Install and open

5 Oct 18, 2022

A program analysis tool to find cryptographic misuse in Java and Android.

92 Dec 15, 2022

CRYLOGGER: Detecting Crypto Misuses for Android and Java Apps Dynamically

139 Dec 12, 2022

A tool translate a apk file to stantard android project include so hook api and il2cpp c++ scaffolding when apk is a unity il2cpp game. Write code on a apk file elegantly.

FakerAndroid (FakerAndroid.jar or FakerAndroid-AS) A tool translate a apk file to stantard android project include so hook api and il2cpp c++ scaffold

231 Dec 29, 2022

Secure your REST APIs with Spring Security, Resource and Authorization Server from zero to JWT

Secure REST APIs with Spring ./mvnw RTFM YouTube: Spring Security Patterns YouTube: Spring Security 5.5 From Taxi to Takeoff Official Apache Maven doc

1 Dec 5, 2021

Writeup and exploit for installed app to system privilege escalation on Android 12 Beta through CVE-2021-0928, a `writeToParcel`/`createFromParcel` serialization mismatch in `OutputConfiguration`

52 Dec 30, 2022

UNIX-like reverse engineering framework and command-line toolset

Radare2: The Libre Unix-Like Reverse Engineering Framework See the Releases page for downloads. The current git master branch is 5.7.7, next will be 5

17.4k Jan 9, 2023

Coinbase-pro-feed-kotlin - Kotlin Coinbase Pro Level 2 Order Book Feed

Kotlin Coinbase Pro Level 2 Order Book Feed Quick start Depending on your OS run

0 Jan 2, 2022

Burp extension to create target specific and tailored wordlist from burp history.

173 Jan 2, 2023

Burp-ipv - Insertion point visualizer for Burp Suite

Insertion point visualizer for Burp Suite Building Execute ./gradlew build and y

1 Feb 2, 2022

Automated-build-android-app-with-github-action - CI/CD Automated Build Android App Bundle / APK / Signed With Github Action

Automated Build Android With Using Github Action Project Github Action Script Us

34 Dec 19, 2022

Custom circular SeekBar (Circle, Semi-circle, and Ellipse) View/Widget for Android

Comments

[Feature Request] Custom Burp Scan configurations

Hi,

Firstly thanks for the tooling :)

While trying out the extension I noticed that currently it uses the default burp scan configurations, Where as if we launch a scan manually it allows to chose from inbuilt or custom burp scan configurations before the scan.

What it majorly helps with is to make the scanner more efficient and lowers the number of request sent to the server. For example I am not interested in flash related findings, hence those checks are disabled in my custom scan configuration and hence it never would have checked for it.

So I think it would be great feature to allow users to configure this in options tab under Scan Configuration heading allowing them to choose the scan configuration.

-- Regards, @bugbaba

opened by bugbaba 1
Feature Enhancement - Agregatte Parameters Scanned

Hi,

Just watched your talk from earlier in the year and i have been dealing with Portswigger support on similar issues. Controller looks like a great answer to some of my issues. While Controller will reduce duplication at the request level Burps selection of injection points is still a bug bear for optimal scanning. While there are definitely advantages in scanning the same headers and parameters on different requests it would be good if there was a way to report on and de-duplicate at the injection point level. Just some report of what was being scanner would help identify injection points missed by the default scanner so they can be manually added and scanned. From your experience with Controller how feasible would it be to collate and report on the injection points being scanned and optimize those injection points into the scanner ?

I ask as i find myself constantly using 'manually send to scanner' due to the large number of parameters and requests involved in complex applications. For an initial scan it isn't a good use of time to be scanning headers and cookies over and over again in different requests. I've had tickets open with Portswigger as their de-duplication doesn't appear to work as per the documentation. i've been thinking of writing a tool to do this myself and it seems like Controller might be the correct place for this capability also.

opened by AkikoOrenji 1

Improve automated and semi-automated active scanning in Burp Pro

Related tags

Overview

PentagridScanController

Improve Automated and Semi-Automated Active Scanning

Requirements

Compiling

Howto use this extension

Performance discussion

Ideas for future improvements

You might also like...

A program to flip every private, protected and package-private access flag to public in an Android dex file!

A simple android app that parses its own signature and displays it

A program analysis tool to find cryptographic misuse in Java and Android.

CRYLOGGER: Detecting Crypto Misuses for Android and Java Apps Dynamically

A tool translate a apk file to stantard android project include so hook api and il2cpp c++ scaffolding when apk is a unity il2cpp game. Write code on a apk file elegantly.

Secure your REST APIs with Spring Security, Resource and Authorization Server from zero to JWT

Writeup and exploit for installed app to system privilege escalation on Android 12 Beta through CVE-2021-0928, a `writeToParcel`/`createFromParcel` serialization mismatch in `OutputConfiguration`

UNIX-like reverse engineering framework and command-line toolset

Coinbase-pro-feed-kotlin - Kotlin Coinbase Pro Level 2 Order Book Feed

Burp extension to create target specific and tailored wordlist from burp history.

Burp-ipv - Insertion point visualizer for Burp Suite

Automated-build-android-app-with-github-action - CI/CD Automated Build Android App Bundle / APK / Signed With Github Action

Custom circular SeekBar (Circle, Semi-circle, and Ellipse) View/Widget for Android

WolfxPaper - A Paper fork designed for Wolfx Survial, may useful for some Semi-Vanilla Server

QCalc - A lightweight semi-scientific calculator for Android

A semi-official port of the open source Anki spaced repetition flashcard system to Android

FCM : FirePush is a lightweight Kotlin/Android library to send FCM push notifications to Android, iOS & Web like a pro.

Authenticator Pro is a free open-source two factor authentication app for Android

Belajar Android Jetpack Pro Dicoding - with Hilt, LiveData, Online-Offline Caching, etc

Comments

[Feature Request] Custom Burp Scan configurations

Feature Enhancement - Agregatte Parameters Scanned

Releases(0.1)

0.1(Jun 16, 2022)

Owner

Pentagrid AG

Burp-ipv - Insertion point visualizer for Burp Suite

MiHawk 🦅👁️ is simple and secure 🔒 Android Library to store and retrieve pair of key-value data with encryption , internally it use jetpack DataStore Preferences 💽 to store data.

Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.

Grab’n Run, a simple and effective Java Library for Android projects to secure dynamic code loading.

Android virtual machine and deobfuscator

BlackDex is an Android unpack tool, it supports Android 5.0~12 and need not rely to any environment. BlackDex can run on any Android mobile phones or emulators, you can unpack APK File in several seconds.

A simple and opinionated AES encrypt / decrypt Ruby gem that just works.

Simple API to perform AES encryption on Android. This is the Android counterpart to the AESCrypt library Ruby and Obj-C (with the same weak security defaults :( ) created by Gurpartap Singh. https://github.com/Gurpartap/aescrypt

A Java ePub reader and parser framework for Android.