Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

Burp Bounty - Scan Check Builder (BApp Store) Download releases: https://github.com/wagiro/BurpBounty/releases/ This Burp Suite extension allows you, in a quick and simple way, to improve the active and passive burps

README
Issues 12

Burp Bounty - Scan Check Builder (BApp Store)

Download releases:

https://github.com/wagiro/BurpBounty/releases/

This Burp Suite extension allows you, in a quick and simple way, to improve the active and passive burpsuite scanner by means of personalized rules through a very intuitive graphical interface. Through an advanced search of patterns and an improvement of the payload to send, we can create our own issue profiles both in the active scanner and in the passive.

Usage

Go to Usage section.

Profiles

Profiles from egarme in Github
Profiles from Gocha in their Github
Profiles from Sy3Omda in their Github

For example videos please visit our youtube channel:

YouTube

Blind RCE with BurpBounty using Burp Collaborator

Donations

If you like this extension, you can collaborate to continue developing it and improve it faster:

Paypal - https://paypal.me/Burpbounty

6 Open More issues

Closed

Scan Check Builder not working on version v1.7.37 Pro

I am using Java v1.8.201 and I am using Scan Check Builder v3.0.5beta from the Bapp store. Even creating a simple profile to look for character 'a' in a passive response is not yielding any result.

See below: -

opened Dec 7, 2019 by manasmbellani 14

Closed

Can't save created profiles

Awesome extension, but I'm having some trouble trying to save profiles that I have created. Nothing is showing up sadly after I try to add tags. I'm using v2.1.03 on Burp.

opened Aug 20, 2019 by Comodooo 11

Closed

Checks only one regex on a page although a list is given

It only gets one regex find although there are more.

opened Apr 6, 2020 by nerrorsec 8

Closed

Scan Check Builder not working on version v1.7.37 & 2.X.X

Hi,

I spent many hours trying to make it work without success. I have tested many versions from Java v1.8.X and I am using Scan Check Builder v3.0.5\6. Most of the time scanner not yield anything in PASSIVE mode and when I using ACTIVE mode, its not firing any payloads. It is only send the payloads when I using the default profiles. If I try to make a new profile from scratch or even change any exist profile, it stop work.

Another bug: In profile definition and in profile manager when I try to customize or change an exist profile, it become duplicated in profile manager, If I try to delete a profile from the button (Remove) its not work at all.

Last thing, I didnt receive any bugs from Java or from the output in the extender.

Thanks.

opened Mar 7, 2020 by Nexsus1985 7

Closed

"ProfileManager" button not works

Today were released two new versions of Burp 2.0.10 and 2.0.11

I'm using BurpBounty 2.3 version and seems that "ProfileManager" button not works anymore, I click on it but nothing happen. Can you check please?

"Profile Directory" is fine

Thank you

opened Oct 31, 2018 by Teicu 6

Closed

A bug in "Exclude HTTP headers"

Thanks for the quick implementation of "Exclude HTTP headers". However, I think it contains a bug. I added a payload, which is once reflected within the "x-request-path: " header, and then in the body it appears on 7 different places: However, even though I see these occurrences in the Session Tracer, there is no issue reported by this extension. Here is my setup: I assume it matches the payload only once, and since it happens to occur in the header, the rest of found bugs are ignored.

opened Jun 7, 2018 by Hipapheralkus 6

Open

NullPointerException

Hi, I am using Burp Pro v2020.12 and BB v3.6. I am getting the following exception while the scan is running:

java.lang.NullPointerException
	at burp.ev3.analyzeRequest(Unknown Source)
	at burp.c3g.analyzeRequest(Unknown Source)
	at burpbounty.BurpBountyExtension.getInsertionPoints(BurpBountyExtension.java:128)
	at burp.gtz.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:830)

This exception comes over and over again (more than 1 time per second). I am not sure if it impacts the scan in any way.

opened Dec 14, 2020 by tatulea 0

Open

Bug - no errors and progress is not saved when creating a new BB profile without name

No errors after exiting from profile creation when we click on the Add button without the BB profile name. Progress also is not saved.

opened Nov 11, 2020 by w9w 0

Open

java.lang.IllegalArgumentException: Invalid severity

burp extender errors pages says: java.lang.IllegalArgumentException: Invalid severity at burp.a33.a(Unknown Source) at burp.hl9.(Unknown Source) at burp.gj2.run(Unknown Source) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) java.lang.IllegalArgumentException: Invalid severity at burp.a33.a(Unknown Source) at burp.hl9.(Unknown Source) at burp.gj2.run(Unknown Source) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) java.lang.IllegalArgumentException: Invalid severity at burp.a33.a(Unknown Source) at burp.hl9.(Unknown Source) at burp.gj2.run(Unknown Source) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) java.lang.IllegalArgumentException: Invalid severity at burp.a33.a(Unknown Source) at burp.hl9.(Unknown Source) at burp.gj2.run(Unknown Source) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) java.lang.IllegalArgumentException: Invalid severity ... is there any bug?

opened Nov 4, 2020 by nancheal 0

Open

Add payload encoding on burp "nested insertion" way

I found that the encoding used by burpbounty is buildUnencodedRequest, maybe add the encoding of buildRequest, like this https://forum.portswigger.net/thread/design-new-extension-problem-with-buildrequest-and-url-encode-5d4b35a6 Can solve more problems. Can this requirement be added?

opened Oct 25, 2020 by nancheal 4

Open

Open_Redirect.bb profile cause error BurpBountyExtension line 174: null

hi first, I want to thank you for your Extension i just discoverd it, i tried to play with profiles included in this repo. i noticed that Open_Redirect.bb cause an error "error BurpBountyExtension line 174: null " that makes the audit ignore all other profiles. my burpsuite professional v2.1.07. i removed the profile that cause the problem but since it's on repo i just want to write a note for that.

opened Oct 9, 2020 by ayadim 0

Open

Burp Suite Professional v2020.9.1

Does anyone have an issue using this extension in the new version of Burp Suite Professional v2020.9.1 ?

I am unable to get known findings from previous versions in this new version.

Thanks!

opened Sep 11, 2020 by Mijobar 2

Information

Category: Java / Miscellaneous
Watchers: 57
Star: 1k
Fork: 236
Last update: Mar 1, 2021

Resource links

https://github.com/wagiro/BurpBounty

Share this repo

Related Repos

Miscellaneous

1.3k

Java Unmarshaller Security - Turning your data into code execution

Java Unmarshaller Security - Turning your data into code execution Paper It's been more than two years since Chris Frohoff and Garbriel Lawrence have presented their research into Java object deserialization vulnerabil

Miscellaneous

612

Object-Oriented Java primitives, as an alternative to Google Guava and Apache Commons

Project architect: @paulodamaso ATTENTION: We're still in a very early alpha version, the API may and will change frequently. Please, use it at your own risk, until we release version 1.0. You can view our progress tow

Miscellaneous

2.5k

Beaker Extensions for Jupyter Notebook

BeakerX: Beaker extensions for Jupyter BeakerX is a collection of JVM kernels and interactive widgets for plotting, tables, autotranslation, and other extensions to Jupyter Notebook. BeakerX is in beta and under active

Miscellaneous

4.8k

Speech and Vision Based Intelligent Personal Assistant

Lucida Lucida is a speech and vision based intelligent personal assistant inspired by Sirius. Visit our website for tutorial, and Lucida-users for help. The project is released under BSD license, except certain submodules contain

Miscellaneous

764

A syntax highlighting, code folding text editor for Java Swing applications.

RSyntaxTextArea RSyntaxTextArea is a customizable, syntax highlighting text component for Java Swing applications. Out of the box, it supports syntax highlighting for 40+ programming languages, code folding, search and replace

Miscellaneous

3.2k

Reactor Bill Of Materials (tracking reactor-core, reactor-netty and more)

Reactor Project Starting from 3.0, Reactor is now organized into multiple projects: A set of compatible versions for all these projects is curated under a BOM ("Bill of Materials"). Using the BOM with Maven In

Miscellaneous

1.8k

Google Reader inspired self-hosted RSS reader.

CommaFeed Sources for CommaFeed.com. Google Reader inspired self-hosted RSS reader, based on Dropwizard and AngularJS. CommaFeed is now considered feature-complete and is in maintenance mode. Related open-source proj

Miscellaneous

433

Demo to show how Apache Kafka can be used for communication between microservices

Microservice Kafka Sample Deutsche Anleitung zum Starten des Beispiels This is a sample to show how Kafka can be used for the communication between microservices. The project creates Docker containers. It uses three microservi