search

CoffeeITWorks / ansible_burp2_server

Ansible role to deploy burp2 server
MIT License
10 stars 9 forks source link

Confused with profiles #90

Open ohmer1 opened 1 year ago

ohmer1 commented 1 year ago

Hello,

Sorry if this is a dummy question, but I wonder, what's the use case for this task? It create a "lnxsrv profile" file in /etc/burp/clientconfdir/profiles but I fail to see where and how it's used. I see there is also /etc/burp/clientconfdir/incexc/profile_lnxsrv. Here I understand it allow to define a profile to a client that share a similar configuration. Are they related? Why a profile would contain a client password ?

Thank you!

pablodav commented 1 year ago

Sorry for my late reply,

I will try to check for. Better clarification tomorrow.

In advance, one is for a burp incexc profile and the other is more like as a template to be used when creating a new client.

I will try to make it more clear.

El jue, 12 de ene. de 2023 19:45, ohmer1 @.***> escribió:

Hello,

Sorry if this is a dummy question, but I wonder, what's the use case for this task https://github.com/CoffeeITWorks/ansible_burp2_server/blob/master/tasks/4_config_burp.yml#L78? It create a "lnxsrv profile" file in /etc/burp/clientconfdir/profiles but I fail to see where and how it's used. I see there is also /etc/burp/clientconfdir/incexc/profile_lnxsrv. Here I understand it allow to define a profile to a client that share a similar configuration. Are they related? Why a profile would contain a client password ?

Thank you!

— Reply to this email directly, view it on GitHub https://github.com/CoffeeITWorks/ansible_burp2_server/issues/90, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABCA7H55IA2VRMQ7OIDA4QLWSCCQDANCNFSM6AAAAAATZYTA3I . You are receiving this because you are subscribed to this thread.Message ID: @.***>

ohmer1 commented 1 year ago

Hello,

Yes I also thought that the file in the clientconfdir/profiles directory was a client template, but it doesn't appear to be used anywhere if I understand correctly. Maybe the idea was to include that file in the profiles_templates.content variable, but a static password for all clients that share the same profile would not make sense.

Thank you!

pablodav commented 1 year ago

Yes Ohmer! thanks you for raising this up.

The idea looks very old and deprecated, I'm pretty sure I don't use it at all on my servers but I will have to review all the deploys before cleaning this up.

I will keep it open to remmember to cleanup it.