> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/burp-scanner-reference.md).

# Burp Suite Enterprise Edition step configuration

You can configure the [Burp Suite Enterprise Edition](https://portswigger.net/burp/enterprise) step in your pipeline to perform Dynamic Application Security Testing (DAST). The step supports multiple scan modes and customizable scan configurations to suit different testing needs.

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Burp Suite Enterprise Edition step settings <a href="#burp-suite-enterprise-edition-step-settings" id="burp-suite-enterprise-edition-step-settings"></a>

The recommended workflow is to add a **Burp Suite Enterprise Edition** step to a **Security** or **Build** stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

The following configurations are available for **Orchestration** scans. These are [built-in configurations](https://portswigger.net/burp/documentation/scanner/scan-configurations/burp-scanner-built-in-configs) provided by Burp Enterprise.

* **Default** – This is the same as the **Crawl and Audit - Lightweight** built-in configuration.
* **Never stop Crawl due to application errors**
* **Never stop audit due to application errors**
* **Minimize false positives**
* **Minimize false negatives**
* **Crawl strategy most complete**
* **Crawl strategy more complete**
* **Crawl strategy fastest**
* **Crawl strategy faster**
* **Crawl limit 60 minutes**
* **Crawl limit 30 minutes**
* **Crawl limit 10 minutes**
* **Crawl and audit lightweight**
* **Crawl and audit fast**
* **Crawl and audit deep**
* **Crawl and audit balanced**
* **Audit coverage thorough**
* **Audit coverage maximum**
* **Audit checks medium active**
* **Audit checks light active**
* **Audit checks critical issues only**
* **Audit checks all except time based detection methods**
* **Audit checks all except java script analysis**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

The fully-qualified URL to the scanner.

**Access Token**

The access token used to log in to a specific product in the scanner. This is required for some scans. In most cases, this is a password or an API key.

You should create a Harness text secret with your encrypted token and reference the secret using the format `<+secrets.getValue("container-access-id")>`. For more information, go to [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

#### URL Scope <a href="#url-scope" id="url-scope"></a>

{% tabs %}
{% tab title="Default" %}
To configure the URL Scope using the **Default Scope**, set the following fields as described below:

#### Instance <a href="#instance" id="instance"></a>

**Domain**

**Protocol**

**Port**

**Path**

**Username**

Username to log in to the instance you want to scan.

**Password**

The access token to log in to the instance you want to scan. In most cases, this is a password or an API key.
{% endtab %}

{% tab title="Detailed Scope" %}
To configure the URL Scope using **Detailed Scope**, you must set the following fields as described. For more information, refer to the Burp Suite documentation on [Detailed Scope Configuration](https://portswigger.net/burp/documentation/dast/user-guide/scanning-webapps-and-apis/setting-site-scope).

#### Instance <a href="#instance" id="instance"></a>

**Username**

Username to log in to the instance you want to scan.

**Password**

The access token to log in to the instance you want to scan. In most cases, this is a password or an API key.

#### Scope <a href="#scope" id="scope"></a>

**Start URLs**

Enter the URLs that you want Burp Scanner to start scans from. Scans only send requests to URLs that are in scope. By default, Burp Scanner automatically bases the scope on the start URLs. This is the same as the `start_urls` parameter in the Burp API. You can specify multiple URLs separated by commas. For example, `https://ginandjuice.shop/,https://ginandjuice.shop/about`

**In Scope URL Prefixes**

Add URL prefixes to modify the site scope. Burp Scanner can only scan URLs that begin with one of these prefixes. Your Start URLs need to be in scope. This is the same as the `in_scope_url_prefixes` parameter in the Burp API. You can specify multiple URLs separated by commas. For example, `https://ginandjuice.shop/,https://ginandjuice.shop/about`

**Out of Scope URL Prefixes**

Exclude URL prefixes from the site scope. All paths that start with the URL prefix are out of scope. This is the same as the `out_of_scope_url_prefixes` parameter in the Burp API. You can specify multiple URLs separated by commas. For example, `https://ginandjuice.shop/blog,https://ginandjuice.shop/image/`
{% endtab %}
{% endtabs %}

You should create a Harness text secret with your encrypted token and reference the secret using the format `<+secrets.getValue("container-access-id")>`. For more information, go to [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>