Using burp-rest-api, how do I log into my web application in order to scan for vulnerabilities?

Question

I am using the VMWare-developed Burp API (https://github.com/vmware/burp-rest-api) in order to try to automate web application scanning for my application. For an example, if I was attempting to test port 85 of localhost, the process would be as follows.

# Add the target to scope
curl -X PUT --header 'Content-Type: application/json' --header 'Accept: application/json' 'http://localhost:8080/burp/target/scope?url=http://127.0.0.1:85'

# Spider the target
curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' 'http://localhost:8080/burp/spider?baseUrl=http://127.0.0.1:85'

# Scan the target
curl -X POST --header 'Content-Type: application/json' --header 'Accept: */*' 'http://localhost:8080/burp/scanner/scans/active?baseUrl=http://127.0.0.1:85'

# Get Status of Scan
curl -X GET --header 'Accept: application/json' 'http://localhost:8080/burp/scanner/status'

# Create HTML Report
curl -X GET --header 'Accept: application/octet-stream' 'http://localhost:8080/burp/report?urlPrefix=http://127.0.0.1:85&reportType=HTML' -o testReport.html

Is there a way to log in before/during the spidering process through the API, so the spider will crawl authenticated pages as well?

Answer 1

#Pass the user/project config json file 
curl -X POST "http://localhost:8080/burp/configuration" -H "accept: */*" -H "Content-Type: application/json" -d "\"string\""

modify the following lines in project_config json file or string to spider the application based on form based login/authentication.

   ...

    ...

        "spider": 

          {  "application_login": 

             {  "mode": "automatic",

                  "password": " ",

                  "username": " "
             },

               "crawler": 

    ...

    ...

Note : the project_config json example can be found in API documentation

Answer 2

As PortSwigger guys mentioned in the comments, if you want to trigger the scan through API, better use the new official burp API. however, here is an alternative way if you have selenium based automation set up.

In this case you can use burp scanner to perform a security scan while you are running you functional test cases. All you need to do is configure your target browser to point to burp proxy. You functional test cases would take care of authentication in this case and furthermore it would give you better coverage.

In my experience this works best if you are running Burp scanner in passive scan mode as an active scan may interfere with your functional test cases. The APIs can be used to fetch the report once the run is complete. This approach may be used to integrate burp to your CI/CD pipeline, as Burp does not have great support for tools like Jenkins.