Back to Blogs

Elevating security testing: The power of Burp suite checks in Burp Suite

Kaustubh RaiJan 16, 20245 min read

Talk to an expert

about something you read on this page

Contact an expert
Blog_AAH_ProfServices.png

In the dynamic world of cybersecurity, tools that offer customization and flexibility are invaluable. And, Burp Suite, renowned for its comprehensive capabilities in security testing, stands at the forefront of this landscape. For those new to security testing, Burp Suite is a tool for comprehensive analysis and probing of web applications for security. It caters to various security aspects and finds vulnerabilities by combining automated and manual testing.

Among its suite of features, BChecks or Burp suite checks (introduced in version v2023.6) is an innovative component exclusively available in Burp Suite Professional that introduced an approach to customizing security scans within Burp Suite, offering users the ability to script and tailor security tests to their specific needs.

In this blog, discover how BChecks enhances Burp Suite's functionality for effective security testing. Explore their transformative role, impact on the scanning engine, and why they are valuable to any tester's toolkit. Whether you're a seasoned professional or new to security, unlocking the power of BChecks will broaden your horizons in security testing.

Burp suite bcheck-reported-issues

Understanding Burp suite checks: Beyond standard scanning

Burp Suite (Bcheks) has long facilitated vulnerability scanning through its built-in scanner and the diverse extensions available on the BApp Store. However, the introduction of BChecks marks an advancement in the realm of customization for security testing.

Traditionally, while using Burp Suite's Vulnerability Scanner and extensions, users often faced limitations regarding the number of extensions they could enable, primarily due to memory constraints. Overloading with extensions could lead to system performance issues, restricting the scope of simultaneous scans.

BChecks circumvent the limitations traditionally encountered with extensions. These scripted checks, running seamlessly within the Burp Suite environment, offer the versatility of extensions without the associated system impact. You can now create a multitude of BChecks to operate concurrently without burdening the system. They continuously monitor and flag security issues, clearly marked as "BCheck generated" in the Target and Dashboard, offering a streamlined and efficient security testing process.

This new feature broadens the scope of what can be tested and enhances efficiency. Testers can conduct more targeted and effective scans by tailoring BChecks to specific security concerns or vulnerabilities. This targeted approach is not just a step up in customization; it represents a leap toward more intelligent, adaptive, and efficient security testing.

The evolution of security testing with scripting: Traditional methods vs. Bupr checks approach

Security testing has always been a game of cat and mouse, with tools and techniques constantly evolving to keep pace with emerging threats.

Traditional security testing often relied on predefined scans and manual efforts. This method, while effective, had limitations in adaptability and scalability. Traditional methods often required writing extensive functions and extensions in specific programming languages, a process that could be daunting for those not well-versed in these languages. This approach often involved meticulous planning, trial and error, and significant time investment, especially when multiple functions or extensions were needed.

With BChecks, the dynamics have changed. With their simple scripting language, BChecks allow for the creation of checks for almost anything imaginable, significantly reducing the time and effort involved in scripting specific functions or developing full extensions. For an in-depth understanding of BCheck's scripting language, refer to the BCheck Definition Reference.

The ability to write scripts that directly address specific vulnerabilities or testing scenarios transforms the scanner from a generic tool into a precision instrument tailored to individual needs.

Key Comparisons:

  • Complexity of Development: BChecks offers a user-friendly scripting language instead of the Traditional Methods of requiring in-depth knowledge, accessible even to those with limited coding experience.
  • Time Investment: Bchecks offers quick creation and deployment, streamlining the whole process.
  • Resource Efficiency: BChecks minimizes system impact, allowing for multiple checks simultaneously without degrading performance.
  • Community Collaboration: Traditional Methods are limited to scope for community due to complexity and specificity whereas BChecks encourages community involvement enhancing the tool's capabilities through collaborative efforts.

Diving into the capabilities of Burp suite checks

BChecks offers a suite of capabilities that enhance the scope and efficacy of security testing. Some of these key features empower testers to conduct comprehensive and targeted security assessments:

Conditional Logic: BChecks enable conditional statements, allowing checks to be executed based on specific criteria. This capability ensures that scans are both relevant and efficient, focusing on areas of potential vulnerability.

Syntax:


1] if [condition] then

[action]

end if

2] if [condition 1] then

[action 1]

else if [condition 2] then

[action 2]

end if

3] if [condition] then

[action]

else then

[action 2]

end if

Example: Create a check that reports an issue if the response contains any headers that give information about its server.

Burp-suite-conditional logic

Regular Expression (Regex) Matching: With regex support, BChecks can precisely identify patterns in HTTP requests and responses. This precision is crucial in detecting complex vulnerabilities and specific security issues. BChecks supports Java-style regex. "2[0-9][0-9]"

Syntax

`{variable} matches "[regex]"`

Example: Detect email addresses in responses

Burpe suite regular expression

Custom HTTP Requests: BChecks allow the sending of custom HTTP requests, facilitating the testing of unique or unconventional attack vectors that standard scans might miss.

Syntax:

send request: method: "GET"

Example: Check for exposed admin panels

Burpe suite custom http request

Interaction with Burp Collaborator: BChecks can interact with Burp Collaborator for advanced testing scenarios, such as out-of-band vulnerability detection, enhancing the ability to uncover hidden or hard-to-detect issues.

Syntax:

`{generate_collaborator_address()}`

Example: Detect blind XSS vulnerabilities.

Burp suite detect blind xss

Programmatic Payload Delivery: Testers can use BChecks to programmatically trigger payloads upon discovering insertion points, allowing for dynamic and responsive testing strategies.

Syntax:

`send payload: appending: "test payload"`

Example: Test for reflected XSS.

Burp suite programmatic payload

Custom Issue Reporting: BChecks provides the functionality to raise findings with detailed descriptions, severity levels, and remediation advice. This feature aids in the clear communication and prioritization of identified issues.

Syntax:

`report issue: severity: confidence: remediation: detail:`

Example: Report issues for any AWS Keys found in response.

Burp suite custom issue reporting

Helper Functions: The scripting language includes helper functions for common operations like MD5, SHA1, SHA256 hashing, and Base64 encoding/decoding, streamlining the script writing process.

Syntax:

{base64_encode(string)}, sha1(String), sha256(String), md5(String)

Example: Encode sensitive data before transmission.

Burpe suite helper function

Crafting Effective BChecks - Tips and Best Practices

Crafting effective BChecks requires a blend of technical know-how and strategic thinking. Some tips to create a basic Bcheck script are:

  1. Start with a Clear Objective: Define what you want to achieve with your BCheck script. Understanding the specific vulnerability or issue you are targeting is crucial.
  2. Keep It Simple: Start with simple checks and gradually build complexity. Avoid overcomplicating scripts as it can lead to inefficiencies.
  3. Test Thoroughly: Regularly test and refine your scripts to ensure they are effective and do not produce false positives.
  4. Stay Updated: Keep abreast of the latest security trends and update your scripts accordingly.
  5. Leverage Community Resources: Use examples from the BChecks GitHub repository as references and inspiration.

Creating a Basic BCheck Script:

Let's create a simple BCheck script that detects whether a website’s login page uses HTTP instead of HTTPS, a potential security risk.

Here are the steps:

Burpe suite Bcheck script creation

  • Define the Metadata: Start by defining basic information about your check.

metadata:

language: v1-beta

name: "Insecure Login Check"

description: "Detects if login pages are served over HTTP"

author: "Your Name"
  • Set Up Trigger Condition (steps 2 and 3 combined): Specify the trigger that should run for each host. You can define the logic you need to implement and the subsequent actions.
given host then
  • Send a request and check the response (steps 4 and 5 combined): Send a request to the login page and check if it’s served over HTTP. In case you encounter any issues, you can report them.

send request called login_page_check:

method: "GET"

path: "/login"

if {login_page_check.response.url.protocol} is "http" then

report issue:

severity: medium

confidence: certain

detail: "Login page served over insecure HTTP."

remediation: "Switch to HTTPS to secure the login page."

end if

This script is a basic example, but it illustrates creating a BCheck – from defining the metadata to scripting the logic and reporting issues. 

Following similar steps and applying the best practices, you can develop a wide range of custom BChecks to enhance your security testing with Burp Suite Professional.

For more working examples demonstrating various use cases, visit Portswigger’s Worked Examples.

The community angle: Sharing and collaboration

BChecks offers technical prowess and opens avenues for community collaboration and knowledge sharing. This aspect is critical in the ever-evolving cybersecurity landscape, where collective wisdom can significantly amplify individual efforts.

The BChecks GitHub repository offers a wide array of solutions and ideas for security testing. Exploring these scripts allows you to gain insights into diverse security testing scenarios and methodologies.

Review scripts from other professionals and contribute your BChecks to the repository. The community can cover various vulnerabilities and scenarios by sharing and adapting scripts.

Future-proofing security testing with BChecks

The role of BChecks in security testing is poised to expand, addressing increasingly sophisticated cybersecurity threats. Expect BChecks to integrate deeper levels of automation, enabling even more complex security testing scenarios with minimal manual intervention.

Incorporating AI in creating custom BChecks to predict and identify emerging vulnerabilities, adapting the testing process in real-time.

As the user community grows, various scripts and use cases will emerge. With its growing popularity BChecks would lead to wider adoption and could become a standard component in security testing suites.

As we conclude this exploration of BChecks, it's clear that they represent a significant advancement. By offering this customization, efficiency, and community collaboration, BChecks enables security professionals to conduct more targeted, effective, and comprehensive security assessments.

We encourage you to experiment with BChecks, share your experiences, and contribute to the growing body of knowledge in the Burp Suite community. Here’s the repository where you can contribute to BChecks - https://github.com/PortSwigger/BChecks. Whether enhancing existing scripts or developing new ones, your contribution is a step towards a more secure digital world.

About Contentstack

The Contentstack team comprises highly skilled professionals specializing in product marketing, customer acquisition and retention, and digital marketing strategy. With extensive experience holding senior positions in notable technology companies across various sectors, they bring diverse backgrounds and deep industry knowledge to deliver impactful solutions.  

Contentstack stands out in the composable DXP and Headless CMS markets with an impressive track record of 87 G2 user awards, 6 analyst recognitions, and 3 industry accolades, showcasing its robust market presence and user satisfaction.

Check out our case studies to see why industry-leading companies trust Contentstack.

Experience the power of Contentstack's award-winning platform by scheduling a demo, starting a free trial, or joining a small group demo today.

Follow Contentstack on Linkedin

Share on:

Talk to an expert

about something you read on this page

Contact an expert

Recommended posts