Performing automated scan using Burp Suite Pro & Vmware Burp Rest API with Robot Framework using Python3.
Visit blog for detailed explanation of each step.
- One click run using bash installs all the dependencies with verbose prerequisites.
- Uses python3 and robot framework which is easy to automate.
- Uses Burp Suite Rest API and runs Burp Suite Professional (pre-activated) in the headless mode along with multiple Burp Suite extension like additional-scanner-checks, BurpJSLinkFinder and active-scan-plus-plus.
- Automatically performs pentest of API/Web endpoint including scope addition and deletion using robot script.
- Automatically upload reports in CSV & HTML into Google Drive in YYYY-MM-DD format.
- Slack integration for real time alerts.
- Run this before running automation.sh
- Debian OS(Ubuntu).
- Activated Burp Suite Pro (burpsuite_pro_v2021.6.2.jar) with prefs.xml .
- Vmware Burp Suite Rest API (It will be installed via automated script).
- Python3 & Pip (It will be installed via automated script).
- Robot Framework (It will be installed via automated script).
- Update scope, slack webhook & Google Drive parent folder id in custom_lib_2.py.
- Setting up Google Drive authentication for PyDrive
- Upload credentials (client_secrets.json & mycreds.txt) to GitHub repository for automation script.
mkdir automation
cd automation
wget https://raw.githubusercontent.com/justmorpheus/burp-automation/master/automation.sh
chmod +x automation.sh
bash automation.sh https://github.com/justmorpheus/burp-automation.git
bash automation.sh https://github.com/justmorpheus/burp-automation.git
In case of failure
Run the following command inside the folder python3 -m robot -d output fuzzing.robot
.
- A big thanks to we45, for showing this awesome work.
- This is for educational purpose as Burp Suite is having enterprise license for running it in CI/CD.
- Do not use this in production, this is for learning and understanding Burp Suite Automation.
- Do not use this for illegal purposes.The author does not keep responsibility for any illegal action you do.