Skip to content

Commit 6de9609

Browse files
Changed Readme and Description
1 parent 109306e commit 6de9609

File tree

2 files changed

+30
-17
lines changed

2 files changed

+30
-17
lines changed

BappDescription.html

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,30 @@
11
<h2>5# Scan Controller</h2>
22
Author: Tobias "floyd" Ospelt, @floyd_ch, http://www.floyd.ch<br>
33
Pentagrid AG, 5#, https://www.pentagrid.ch
4+
45
<h3>Improve Automated and Semi-Automated Active Scanning</h3>
56
Active Scanning might often do things that don't make any sense, such as scanning GET requests to .js files or scanning non-repeatable request.
67
This extension allows to filter and preprocess according to your needs. It tries to check if a request is repeatable or not. If a request is not repeatable, it tries to make them repeatable by injecting Hackvertor tags. The extension doesn't try to be perfect, but useful. It cuts corners and in some cases simply doesn't scan certain requests. However, the extension individually displays and explains all decisions, allowing you to change the settings if you don't like the behavior. It's a better "Actively scan all in-scope traffic through Proxy".
8+
79
<h3>Features</h3>
810
<ul>
9-
<li>Everything configurable (interesting/uninteresting, blacklisting requests, etc.)</li>
1011
<li>Check repeatability of requests and try to make them repeatable</li>
12+
<li>Everything configurable (interesting/uninteresting, blacklisting requests, etc.)</li>
1113
</ul>
12-
<h3>Howto use this extension</h3>
14+
15+
<h3>How to use this extension</h3>
1316
Usage is very simple:
1417
<ul>
1518
<li>Add the website you test to the scope</li>
1619
<li>Enable "Proxy requests" in the tab/section "Scan - Options - Requests to process"</li>
1720
<li>Browse the web application (proxy) by using the Burp builtin browser.</li>
18-
<li>Check back on the $tabName tab and see which request have been active scanned. Check those<br>
19-
that have a high "Interesting" rating but haven't been scanned ("Scanned" column set to false)</li>
21+
<li>Check back on the $tabName tab and see which request have been active scanned. Check those that have a high "Interesting" rating but haven't been scanned ("Scanned" column set to false)</li>
2022
<li>See the Dashboard for Active Scan findings</li>
21-
<li>It's always good to sort by the reason column in the UI and check the different reasons.</li>
23+
<li>Hint: It's always good to sort by the reason column in the UI and check the different reasons.</li>
2224
</ul>
25+
2326
<h3>Performance discussion</h3>
2427
Improves performance by not sending everything to active scan.
28+
2529
<h3>Ideas for future improvements</h3>
26-
<ul>
27-
<li>Let me know if you think of any improvements: tobias at pentagrid dot ch.</li>
28-
</ul>
30+
Let me know if you think of any improvements: tobias at pentagrid dot ch.

README.md

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,28 @@
11
# PentagridScanController
2-
Improve automated and semi-automated active scanning for BurpSuite<br>
2+
Improve automated and semi-automated active scanning for BurpSuite
33

4-
Author: Tobias "floyd" Ospelt, @floyd_ch, http://www.floyd.ch<br>
4+
Author: Tobias "floyd" Ospelt, @floyd_ch, http://www.floyd.ch
55

66
Pentagrid AG, 5#, https://www.pentagrid.ch
77

8-
# Compiling
8+
## Improve Automated and Semi-Automated Active Scanning
9+
10+
Active Scanning might often do things that don't make much sense, such as scanning GET requests to static .js files or scanning non-repeatable requests.
11+
This extension allows to filter and preprocess according to your needs. It tries to check if a request is repeatable or not.
12+
If a request is not repeatable, it tries to make them repeatable by injecting Hackvertor tags. The extension doesn't try to be perfect, but useful.
13+
It cuts corners and in some cases simply doesn't scan certain requests.
14+
However, the extension individually displays and explains all decisions, allowing you to change the settings if you don't like the behavior. It's a better "Actively scan all in-scope traffic through Proxy".
15+
16+
## Requirements
17+
18+
This extension uses Hackvertor tags. Make sure [Hackvertor](https://github.com/hackvertor/hackvertor) is installed and active.
19+
20+
## Compiling
921

1022
`gradle clean build jar`
1123

12-
# Improve Automated and Semi-Automated Active Scanning
13-
Active Scanning might often do things that don't make any sense, such as scanning GET requests to .js files or scanning non-repeatable request. This extension allows to filter and preprocess according to your needs. It tries to check if a request is repeatable or not. If a request is not repeatable, it tries to make them repeatable by injecting Hackvertor tags. The extension doesn't try to be perfect, but useful. It cuts corners and in some cases simply doesn't scan certain requests. However, the extension individually displays and explains all decisions, allowing you to change the settings if you don't like the behavior. It's a better "Actively scan all in-scope traffic through Proxy".
24+
## Howto use this extension
1425

15-
# Howto use this extension
1626
Usage is very simple:
1727
* Add the website you test to the scope
1828
* Enable "Proxy requests" in the tab/section "Scan - Options - Requests to process"
@@ -21,10 +31,11 @@ Usage is very simple:
2131
* See the Dashboard for Active Scan findings
2232
* It's always good to sort by the reason column in the UI and check the different reasons.
2333

24-
# Performance discussion
34+
## Performance discussion
35+
2536
Improves performance by not sending everything to active scan.
2637

27-
# Ideas for future improvements
38+
## Ideas for future improvements
2839

29-
* Let me know if you think of any other improvements on the issues tab
40+
Let me know if you think of any other improvements in the issues tab.
3041

0 commit comments

Comments
 (0)