The document discusses using custom scan profiles in Burp Suite to efficiently detect web application vulnerabilities. It introduces Burp Suite's configuration library and built-in scan profiles. It then explains how to create custom scan profiles tailored to specific vulnerability categories. The document demonstrates how custom profiles can efficiently detect vulnerabilities by focusing scans on particular parameters and endpoints. It also discusses extending scanning capabilities through Burp extensions and open source tools.

1. Finding Web Application vulnerabilities
with Burp Suite Scan Profiles

2. #Whoami
MOHAMMAD SAQLAIN (mrroot)
Application Security Engineer
Bug Bounty Hunter

3. Agenda
1. Introduction to Burp Suite Configuration Library
2. Understanding Burp Suite Scan Profiles
3. Creating Burp Suite Custom Scan Profiles
4. Efficiently detecting vulnerabilities with Custom Scan
Profiles
5. Using Burp Extensions and Open Source tools to detect
vulnerabilities

4. Introduction to Burp Suite Configuration Library
Burp Suite comes with a range of built-in setting profiles which can
help users to quickly fuzz an application's endpoints.
Crawl options : control Scanner’s behavior during the crawl phase of the scan.
Audit options : control Scanner's behavior during the audit phase of the scan.

5. Understanding Burp Suite Scan Profiles
https://portswigger.net/burp/documentation/scanner/scan-configurations/burp-scanner-built-in-configs

6. Creating Burp Suite Custom Scan Profiles

7. Creating Burp Suite Custom Scan Profiles

8. Creating Burp Suite Custom Scan Profiles

9. Creating Burp Suite Custom Scan Profiles
Based on the vulnerability category, we can create as many custom profiles as we require
Such as
● Path Traversal
● XML Entity Injection
● Server Side Request Forgery
● Web Cache Poison
● HTTP Request Smuggling
● Cross Origin Resource Sharing
These custom profiles are incredibly useful when you need to search for vulnerabilities
on specific parameters and endpoints, allowing you to efficiently and effectively detect
any potential vulnerabilities.

10. Efficiently detecting vulnerabilities with Custom Scan Profiles
Demo Time

11. Extending Scanning Capabilities :
Active Scan++ - https://github.com/PortSwigger/active-scan-plus-plus
Backslash Powered Scanner
- https://github.com/portswigger/backslash-powered-scanner
Authorization checks :
Auth Analyzer - https://github.com/PortSwigger/auth-analyzer
Upload functionality checks :
Upload Scanner - https://github.com/PortSwigger/upload-scanner
Applying various Encoding, Hashing, and Encryption Techniques :
Hackvertor - https://github.com/portswigger/hackvertor
GraphQL technology security auditing
InQL Scanner - https://github.com/portswigger/inql
Finding Potential Parameters
GAP - https://github.com/xnl-h4ck3r/GAP-Burp-Extension
Other Extensions - https://github.com/snoopysecurity/awesome-burp-extensions
Using Burp Extensions & Open Source tools to detect vulnerabilities

12. Any Questions…

13. Conclusions
● Don’t spray and pray…. Find the right way
● Be a Pentester not Fun Tester
● Remember Human > Machine ( even ChatGPT ) 😂

14. Contact