Burp Suite

https://portswigger.net/burp/documentation
Admin
Burp Suite is an enterprise-grade dynamic web vulnerability scanner and penetration testing toolkit...
Tokens:483,566
Snippets:5,333
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example response.varfile for DAST server deployment

Source: https://portswigger.net/burp/documentation/dast/user-guide/reference/unattended-installation

Example response.varfile for a DAST server deployment. It sets the installation directory, database type, and component flags (agent, db, enterprise, web). Earlier versions required additional database and admin user parameters, but these are now entered during initial setup.

```plaintext
# install4j response file for Burp Suite DAST 2022.11-11262
beuser=burpsuite
beuserandgroup=burpsuite\:burpsuite
dataDirectory=/var/lib/BurpSuiteEnterpriseEdition
dbType=postgres
escapedDataDir=/var/lib/BurpSuiteEnterpriseEdition
escapedInstallationDir=/opt/burpsuite_enterprise
jreHome=/opt/burpsuite_enterprise/jre
logsDirectory=/var/log/BurpSuiteEnterpriseEdition
platformScriptSuffix=sh
sys.adminRights$Boolean=true
sys.adminRightsUiRootUnix$Boolean=true
sys.component.agent$Boolean=false
sys.component.db$Boolean=false
sys.component.enterprise$Boolean=true
sys.component.web$Boolean=true
sys.installationDir=/opt/burpsuite_enterprise
sys.languageId=en
sys.programGroupDisabled$Boolean=true
webserver_port$Integer=8443
```

--------------------------------

### Helm install example

Source: https://portswigger.net/burp/documentation/dast/setup/self-hosted/kubernetes/install-app

Example command to deploy Burp Suite DAST to a deployment called bsee-deployment in the bsee-namespace namespace using a chart in enterprise-helm-folder.

```bash
helm install -n bsee-namespace bsee-deployment enterprise-helm-folder
```

--------------------------------

### Example response.varfile for DAST server

Source: https://portswigger.net/burp/documentation/dast/user-guide/reference/unattended-installation

An example of the response.varfile generated after a manual installation of the DAST server, used to replicate settings during unattended deployment.

```text
# install4j response file for Burp Suite DAST 2022.11-11262 dataDirectory=C\:\\ProgramData\\BurpSuiteEnterpriseEdition dbType=mssql escapedDataDir=C\:/ProgramData/BurpSuiteEnterpriseEdition escapedInstallationDir=C\:/Program Files/burpsuite_enterprise jreHome=C\:\\Program Files\\burpsuite_enterprise\\jre logsDirectory=C\:\\ProgramData\\BurpSuiteEnterpriseEdition platformScriptSuffix=bat sys.adminRights$Boolean=true sys.component.agent$Boolean=false sys.component.db$Boolean=false sys.component.enterprise$Boolean=true sys.component.web$Boolean=true sys.installationDir=C\:/Program Files/burpsuite_enterprise sys.languageId=en sys.programGroupAllUsers$Boolean=true sys.programGroupDisabled$Boolean=false sys.programGroupName=Burp Suite DAST webserver_port$Integer=8443
```

--------------------------------

### Example response.varfile for scanning machine

Source: https://portswigger.net/burp/documentation/dast/user-guide/reference/unattended-installation

An example of the response.varfile generated after a manual installation of a scanning machine, used to replicate settings during unattended deployment.

```text
# install4j response file for Burp Suite DAST 2022.11-11262 dataDirectory=C\:\\ProgramData\\BurpSuiteEnterpriseEdition dbType=mssql enterprise_server_address=x.x.x.x escapedDataDir=C\:/ProgramData/BurpSuiteEnterpriseEdition escapedInstallationDir=C\:/Program Files/burpsuite_enterprise jreHome=C\:\\Program Files\\burpsuite_enterprise\\jre logsDirectory=C\:\\ProgramData\\BurpSuiteEnterpriseEdition platformScriptSuffix=bat sys.adminRights$Boolean=true sys.component.agent$Boolean=true sys.component.db$Boolean=false sys.component.enterprise$Boolean=false sys.component.web$Boolean=false sys.installationDir=C\:/Program Files/burpsuite_enterprise sys.languageId=en sys.programGroupAllUsers$Boolean=true sys.programGroupDisabled$Boolean=false sys.programGroupName=Burp Suite DAST
```

--------------------------------

### Example database transfer command

Source: https://portswigger.net/burp/documentation/dast/user-guide/post-installation-config/migrating-external-db

An example of the manual database transfer command with sample values for version, installation directory, and data directory.

```bash
cd /opt/burpsuite_enterprise/ sudo ./jre/bin/java -cp "databaseTransferTool/2020.6/lib/*" net.portswigger.enterprise.database.transfer.DatabaseTransferMain /opt/burpsuite_enterprise/ /var/lib/BurpSuiteEnterpriseEdition/data
```

--------------------------------

### Example response.varfile for scanning machine deployment

Source: https://portswigger.net/burp/documentation/dast/user-guide/reference/unattended-installation

Example response.varfile for a scanning machine deployment. It sets the enterprise server address and component flags (agent true, enterprise false, web false). Copy this file from an existing scanning machine installation to reuse it.

```plaintext
# install4j response file for Burp Suite DAST 2022.11-11262
beuser=burpsuite
beuserandgroup=burpsuite\:burpsuite
dataDirectory=/var/lib/BurpSuiteEnterpriseEdition
dbType=postgres
enterprise_server_address=x.x.x.x
escapedDataDir=/var/lib/BurpSuiteEnterpriseEdition
escapedInstallationDir=/opt/burpsuite_enterprise
jreHome=/opt/burpsuite_enterprise/jre
logsDirectory=/var/log/BurpSuiteEnterpriseEdition
platformScriptSuffix=sh
sys.adminRights$Boolean=true
sys.adminRightsUiRootUnix$Boolean=true
sys.component.agent$Boolean=true
sys.component.db$Boolean=false
sys.component.enterprise$Boolean=false
sys.component.web$Boolean=false
sys.installationDir=/opt/burpsuite_enterprise
sys.languageId=en
sys.programGroupDisabled$Boolean=true
```

--------------------------------

### Complete extension settings panel implementation

Source: https://portswigger.net/burp/documentation/desktop/extend-burp/extensions/creating/tutorials/settings-panel

A full example demonstrating the creation, registration, and usage of a custom settings panel with various setting types.

```java
import burp.api.montoya.BurpExtension; import burp.api.montoya.MontoyaApi; import burp.api.montoya.ui.settings.SettingsPanelBuilder; import burp.api.montoya.ui.settings.SettingsPanelPersistence; import burp.api.montoya.ui.settings.SettingsPanelSetting; import burp.api.montoya.ui.settings.SettingsPanelWithData;  import java.util.List;  public class Extension implements BurpExtension {     @Override     public void initialize(MontoyaApi api)     {         api.extension().setName("Extension with custom settings");         // Step 1: Create a panel         SettingsPanelWithData panel = SettingsPanelBuilder.settingsPanel()             .withPersistence(SettingsPanelPersistence.USER_SETTINGS)             .withTitle("Example Settings")             .withDescription("A simple settings panel with a few example options.")             .withKeywords("Example", "Settings", "Demo")             // Step 2: Define your settings             .withSettings(                 SettingsPanelSetting.stringSetting("Target host", "example.com"),                 SettingsPanelSetting.integerSetting("Max requests", 100),                 SettingsPanelSetting.booleanSetting("Follow redirects", true),                 SettingsPanelSetting.listSetting("Attack type", List.of("Sniper", "Battering ram", "Pitchfork", "Cluster bomb"), "Sniper")                 )             .build();          // Step 3: Register the settings panel         api.userInterface().registerSettingsPanel(panel);          // Step 4: Access the user-configured setting values         String targetHost = panel.getString("Target host");         int maxRequests = panel.getInteger("Max requests");         boolean followRedirects = panel.getBoolean("Follow redirects");         String attackType = panel.getString("Attack type");          // Step 5: Use the setting values, by logging them to the Output tab         api.logging().logToOutput("Target host: " + targetHost);         api.logging().logToOutput("Max requests: " + maxRequests);         api.logging().logToOutput("Follow redirects: " + followRedirects);         api.logging().logToOutput("Attack type: " + attackType);     } } 
```

--------------------------------

### Starter project Extension.java

Source: https://portswigger.net/burp/documentation/desktop/extend-burp/extensions/creating/set-up/starter-project

The starter project's main extension class. Implements BurpExtension and uses the initialize method to set the extension name and add custom code.

```java
import burp.api.montoya.BurpExtension;
import burp.api.montoya.MontoyaApi;

public class Extension implements BurpExtension {
    @Override
    public void initialize(MontoyaApi montoyaApi) {
        montoyaApi.extension().setName("My Extension");
        // Add your code here
    }
}
```

--------------------------------

### Get selection offsets with offsets()

Source: https://portswigger.net/burp/documentation/desktop/extend-burp/bambdas/creating/writing-custom-actions/writing-guide

Use `offsets()` to get the start and end positions of the selected text in the request. `startIndexInclusive()` and `endIndexExclusive()` return the boundaries needed to replace the selection.

```java
int start = selection.requestSelection().offsets().startIndexInclusive();
int end = selection.requestSelection().offsets().endIndexExclusive();
```
Tokens:
Raw