Scan POST requests - Githubissues

tristanlatr / burpa

Burp Automator - A Burp Suite Automation Tool. It provides a high level CLI and Python interfaces to Burp Suite scanner and can be used to setup Dynamic Application Security Testing (DAST).

GNU General Public License v3.0

190 stars 37 forks source link

Scan POST requests #3

Open c0rv4x opened 3 years ago

c0rv4x commented 3 years ago

Hey!

Is there an option to scan POST requests? Couldn't find it in the docs

Thanks!

tristanlatr commented 3 years ago

Hi @c0rv4x ,

I assume you mean scanning a form URL with the Burp Suite Intruder ? I don't think that's part of the APIs.

Burpa is only a wrapper around existing Burp Suite APIs.

Currently, burpa uses the official REST API to launch the scan, the API help looks like that:

So if you think there is something to do, please be more specific regarding what exactly :)

Thanks,

Regala commented 3 years ago

From what I remember you can do this by:

Proxying the POST request into burp
Issue a scan for that URL; since it's in the proxy history/sitemap it should be picked up and scanned

c0rv4x commented 3 years ago

@tristanlatr yeah dude, their api doesn't support that. I was hoping you found a nice workarount @Regala wow. that would be great. Will try it. Thanks!

Regala commented 3 years ago

np lemme know if you confirm that works so I can start using this project too :P

On Mon, Jun 21, 2021 at 9:38 PM Anatoly @.***> wrote:

@tristanlatr https://github.com/tristanlatr yeah dude, their api doesn't support that. I was hoping you found a nice workarount @Regala https://github.com/Regala wow. that would be great. Will try it. Thanks!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/tristanlatr/burpa/issues/3#issuecomment-865328386, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKRBL6J7B7CBOA6LHFKET3TT6PKNANCNFSM46VZWJLQ .

c0rv4x commented 3 years ago

I am not planning to use burpa at the moment as we have our own implementation of this thing, but it seems that your method doesn't really work. I have added POST request and started scanning that URL and the POST request is not active scanned :(