DOCSEARCHbyAlgolia
Submit Docs

ActiveScan++

repository·master·Indexed 42 days ago

https://github.com/portswigger/active-scan-plus-plus

A Burp Suite extension that enhances active and passive scanning to identify advanced application behaviors and vulnerabilities, including host header attacks, blind code injection, and specific CVEs such as CVE-2014-6271 and CVE-2017-5638, with minimal network overhead.

Tokens
999
Snippets
3
Records
5
Agent score
4%

What's inside ActiveScan++

  1. Capabilities of ActiveScan++

    master

    ActiveScan++ extends Burp Suite's scanning capabilities to identify several categories of advanced vulnerabilities and behaviors:

    Application Behavior Identification

    • Host Header Attacks: Potential password reset poisoning, cache poisoning, and DNS rebinding.
    • Edge Side Includes (ESI): Detection of ESI processing.
    • XML Handling: Identification of XML input handling.
    • Input Transformation: Detection of suspicious input transformations (e.g., 7*7 => '49', \\ => '\').
    • Passive Scanner Integration: Identifies issues that only occur during fuzzing (best used with the 'Error Message Checks' extension).

    Specific Vulnerability Checks

    • Blind Code Injection: Via expression language, Ruby's open(), and Perl's open().
    • Shellshock: CVE-2014-6271, CVE-2014-6278.
    • Other CVEs: CVE-2015-2080, CVE-2017-5638, CVE-2017-12629, CVE-2017-12629, CVE-2018-11776, and more.

  2. Install ActiveScan++ in Burp Suite

    master

    To manually install ActiveScan++, follow these steps within Burp Suite:

    1. Navigate to the Extensions tab.
    2. Go to the Installed sub-tab.
    3. Click Add.
    4. Click Select file.
    5. Choose the file build/libs/active-scan-plus-plus-all.jar from your local directory.

    Requirements:

    • Burp Suite Professional or Enterprise (latest stable version).
    # Manual installation steps:
1. 'Extensions'->'Installed'->'Add'
2. Click 'Select file'
3. Choose build/libs/active-scan-plus-plus-all.jar

  3. Use ActiveScan++ for vulnerability scanning

    master

    ActiveScan++ integrates directly with Burp Suite's scanning engine. To use the extended checks provided by this extension, simply run a standard active scan on your target.

    ActiveScan++ is designed to add minimal network overhead while identifying advanced application behaviors and specific vulnerabilities. For maximum effectiveness, it is recommended to also install the 'Error Message Checks' extension, as ActiveScan++ can trigger fresh passive scans when alternative code paths are identified.

  4. Instantiate a CustomScanIssue for Burp Suite

    master

    When developing custom scan rules for ActiveScan++, use the CustomScanIssue class to represent a discovered vulnerability. This class implements the Burp Suite IScanIssue interface, allowing your custom findings to appear in the Burp Suite issue tracker.

    To instantiate a CustomScanIssue, you must provide the following parameters:

    • httpService: The IHttpService instance used to perform requests.
    • url: The URL where the issue was found.
    • httpMessages: An array of IHttpRequestResponse objects representing the relevant HTTP traffic.
    • name: A string describing the name of the issue.
    • detail: A string containing the technical details of the issue. Note that the class automatically appends a link to the ActiveScan++ GitHub repository for reporting false positives.
    • confidence: A string representing the confidence level of the finding.
    • severity: A value from the CustomScanIssue.severity enum.
    CustomScanIssue issue = new CustomScanIssue(
    httpService, 
    targetUrl, 
    new IHttpRequestResponse[] { requestResponse }, 
    "Vulnerability Name", 
    "Detailed description of the finding.", 
    "Certain", 
    CustomScanIssue.severity.High
);