Burp Probe is a web application that leverages the Burp Suite Pro REST API to provide a centralized and managed platform for conducting scans through a remote instance of Burp Suite Pro.

Features

Distributed Dynamic Scanning

Burp Suite Pro contains a minimal REST API that provides the ability to remotely launch Burp Scanner scans. Burp Probe uses this functionality to launch scans on a remote instance of Burp Suite Pro, or "node". Burp Probe then tracks and monitors the node and its associated scans, providing the ability to review scan results in real-time.

Any usage of Burp Suite Pro with Burp Probe is subject to the Burp Suite Professional Terms & Conditions of Supply that is agreed upon when purchasing a Burp Suite Pro license.

Scanning Through Complex Authentication Systems

Burp Suite Pro can be manually configured to handle complex authentication systems, i.e. MFA, CAPTCHA, OIDC (some exceptions), etc. While this does require directly accessing the node for the purposes of configuration, it makes scanning applications with complex authentication systems possible with Burp Probe. Scanning through these obstacles with Burp Suite Pro is a topic covered in Practical Burp Suite Pro: Advanced Tactics.

Free to Use

Burp Probe is free to use privately and commercially (see LICENSE.txt for more details). However, if you'd like to help fund the time I spend on this project, then I gladly accept donations via PayPal. Thank you!

Getting Started

Requirements

• Docker

Installation

1. Clone the Burp Probe repository.

   git clone https://github.com/lanmaster53/burp-probe.git
   

2. Change into the Burp Probe directory.

   cd burp-probe
   

3. Build the Burp Probe Docker image.

   docker build --rm -t burp-probe .
   

4. Start Burp Probe.

   docker run --rm -it -p 80:80 -v ~/:/burp-probe/data burp-probe
   

   • -rm removes the container when it exits.
   • -it makes the container interactive.
     • Can also be daemonized.
   • -p binds a local and container port.
     • In this case, the application will be available on port 80 of the local host, but can be changed as needed.
   • -v mounts a volume to store the database.
     • In this case, the local host user's home directory is mapped to the /burp-probe/data directory on the container, but can be changed as needed.
     • This is where the SQLite database will be stored.
   • burp-probe the image to use.
     • This was created on the previous step.

Updating

1. Change into the Burp Probe directory.
2. Pull the latest code from the Burp Probe repository.

   git pull
   

3. Rebuild the Burp Probe Docker image.

   docker build --rm -t burp-probe .
   

4. Start Burp Probe using the docker command.

Usage

1. Get the auto-generated username and password from the first time startup output. If you missed this, see the "Fresh Start" section for details on how to try again.
2. Browse to the application at http://127.0.0.1.
3. Log in to the application.
4. Add a scanner node on the "Nodes" page. See the "Deploying Scanner Nodes" section for details on setting up a node.
   • Accessing a Burp Suite Pro instance running on the local host may require the host IP address or host.docker.internal.
5. Configure and run a scan on the "Scans" page.
6. Click the scan to monitor it for results.

Deploying Scanner Nodes

1. Start Burp Suite Pro.
2. Navigate to the "Suite" > "REST API" section of the "Settings" window.
3. Create an API key.
   • Burp Probe does not allow nodes without an API key.
4. Start the REST API service.

Fresh Start

1. Stop and remove the container.
2. Remove the database at ~/burp-probe.db, or wherever the volume was mapped.
3. Run the container.
4. Watch the terminal output.