Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Suite 1.7 and carbonator

Sec | Last updated: Sep 27, 2016 09:33AM UTC

Hi, we were using Burp Suite Pro with Carbonator extension for a long before and it was working well as we have automated scans by launching it from command line. From version 1.7 we had to make some changes in script, looks like scan is working, but report which is generated is empty, shows no issues. Instead, Burp suite shows vulnerabilities in application, but it is not reflected in report at all. Do we need to set something else to generate report with errors in it or we need to use different approach for automation? Thank you, Vaidotas

PortSwigger Agent | Last updated: Sep 27, 2016 02:47PM UTC

We aren't aware of any changes to Burp's API that should prevent scan issues being saved, and this API is still working correctly in our testing. Note that to generate a scan report via the API, it is necessary to supply the issues that should appear in the report. To report on all issues, this can be done easily using e.g.: callbacks.generateScanReport("html", callbacks.getScanIssues(null), new File("/path/to/testreport.html")); This is working fine in the current release of Burp. We would suggest that you look at how your script is interacting with the Carbonator extension.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.