Burp Suite Enterprise Edition step configuration
Scan application instances with Burp.
You can configure the Burp Suite Enterprise Edition step in your pipeline to perform Dynamic Application Security Testing (DAST). The step supports multiple scan modes and customizable scan configurations to suit different testing needs.
Burp Suite Enterprise Edition step settings
The recommended workflow is to add a Burp Suite Enterprise Edition step to a Security or Build stage and then configure it as described below.
Scan
Scan Mode
Scan Configuration
The following configurations are available for Orchestration scans. These are built-in configurations provided by Burp Enterprise.
Default – This is the same as the Crawl and Audit - Lightweight built-in configuration.
Never stop Crawl due to application errors
Never stop audit due to application errors
Minimize false positives
Minimize false negatives
Crawl strategy most complete
Crawl strategy more complete
Crawl strategy fastest
Crawl strategy faster
Crawl limit 60 minutes
Crawl limit 30 minutes
Crawl limit 10 minutes
Crawl and audit lightweight
Crawl and audit fast
Crawl and audit deep
Crawl and audit balanced
Audit coverage thorough
Audit coverage maximum
Audit checks medium active
Audit checks light active
Audit checks critical issues only
Audit checks all except time based detection methods
Audit checks all except java script analysis
Target
Type
Target and variant detection
Name
Variant
Authentication
Domain
The fully-qualified URL to the scanner.
Access Token
The access token used to log in to a specific product in the scanner. This is required for some scans. In most cases, this is a password or an API key.
You should create a Harness text secret with your encrypted token and reference the secret using the format <+secrets.getValue("container-access-id")>. For more information, go to Add and Reference Text Secrets.
URL Scope
To configure the URL Scope using the Default Scope, set the following fields as described below:
Instance
Domain
Protocol
Port
Path
Username
Username to log in to the instance you want to scan.
Password
The access token to log in to the instance you want to scan. In most cases, this is a password or an API key.
To configure the URL Scope using Detailed Scope, you must set the following fields as described. For more information, refer to the Burp Suite documentation on Detailed Scope Configuration.
Instance
Username
Username to log in to the instance you want to scan.
Password
The access token to log in to the instance you want to scan. In most cases, this is a password or an API key.
Scope
Start URLs
Enter the URLs that you want Burp Scanner to start scans from. Scans only send requests to URLs that are in scope. By default, Burp Scanner automatically bases the scope on the start URLs. This is the same as the start_urls parameter in the Burp API. You can specify multiple URLs separated by commas. For example, https://ginandjuice.shop/,https://ginandjuice.shop/about
In Scope URL Prefixes
Add URL prefixes to modify the site scope. Burp Scanner can only scan URLs that begin with one of these prefixes. Your Start URLs need to be in scope. This is the same as the in_scope_url_prefixes parameter in the Burp API. You can specify multiple URLs separated by commas. For example, https://ginandjuice.shop/,https://ginandjuice.shop/about
Out of Scope URL Prefixes
Exclude URL prefixes from the site scope. All paths that start with the URL prefix are out of scope. This is the same as the out_of_scope_url_prefixes parameter in the Burp API. You can specify multiple URLs separated by commas. For example, https://ginandjuice.shop/blog,https://ginandjuice.shop/image/
You should create a Harness text secret with your encrypted token and reference the secret using the format <+secrets.getValue("container-access-id")>. For more information, go to Add and Reference Text Secrets.
Ingestion File
Log Level
Additional CLI flags
Fail on Severity
Last updated
Was this helpful?