search

PortSwigger / BChecks

BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition
https://portswigger.net/burp/documentation/scanner/bchecks
GNU Lesser General Public License v3.0
588 stars 104 forks source link

Add files via upload #144

Closed viny666 closed 7 months ago

viny666 commented 8 months ago

This Bcheck template helps the tester to detect missing authorization in the application or APIs.

Note: Tester has to provide the "Low Privileged Access Token" in the Bcheck script.

Michelle-PortSwigger commented 7 months ago

Hi

Thanks for your sending your BCheck.

While we can see that this could be a really powerful and useful check, we feel that there is a risk of a high number of false positives from it on many sites, so unfortunately it isn't completely suitable for inclusion in the repo where users may bulk download and run BChecks.

There is also a risk that people may download this BCheck and not realize they need to add a token for the low-privileged user. We do want to thank you though, as this is sparking a few ideas here and we'll be having some further discussions to work out how we can take the idea of customizable templates further, so people can easily identify ones that need to be customized when creating and sharing BChecks.

viny666 commented 7 months ago

No Problem, if you need my help in customizing my template in the future, please reach out to me.

Michelle-PortSwigger commented 7 months ago

Thank you, we will :)