Repository files navigation

Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blogAsset Discovery using Burp Suite for more details.

The extension is now part of the BApp store and can be installed directly from the Burp Suite.https://portswigger.net/bappstore/d927f0065171485981d6eb49a860fc3e

To know more about our Attack Surface Management platform, check out NVADR.

Passively parses HTTP response of the URLsin scope and identifies different type assets such asdomain, subdomain, IP, S3 bucket etc. and lists them as informational issues.

• Setup the python environment by providing thejython.jar file in the 'Options' tab under 'Extender' in Burp Suite.
• Download theextension.
• In the 'Extensions' tab under 'Extender', select 'Add'.
• Change the extension type to 'Python'.
• Provide the path of the file ‘Asset_Discover.py’ and click on 'Next'.

• Add a URL to the 'Scope' under the 'Target' tab. The extension will start identifying assets through passive scan.

• Jython 2.7.0
• Burp Suite Pro v2.1

A large portion of the base code has been taken from the following sources:

• OpenSecurityResearch CustomPassiveScanner
• PortSwigger example-scanner-checks

The project is available under MIT license, seeLICENSE file.