Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scope exclude requires include

Slokko | Last updated: Feb 23, 2018 07:18AM UTC

It seems that the In-Scope defining doesn't allow defining scope using only rules that exclude addresses. A way to circumvent this seems to be to make a single include rule for IP-address range 0.0.0.0/0.

PortSwigger Agent | Last updated: Feb 23, 2018 04:30PM UTC

Hi Slokko, Thanks for getting in touch. You're correct, you can only exclude targets if they are already in-scope. This matches the way most people use scope - the scope is configured to match the targets they are authorized to test. I would recommend caution creating a catch all in-scope rule like you suggest as it makes it easier to accidentally active-scan an unauthorized target.

Burp User | Last updated: May 02, 2018 09:02AM UTC

Yeah, in this particular use case the definitions were used to specifically notice any requests heading out of target scope and provide visibility to those requests by filtering out the tens of thousands requests heading to the target scope, hence the need for inverse scoping.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.