burp-scope-monitor: Burp Suite Extension to monitor new scope
Burp Scope Monitor Extension
A Burp Suite Extension to monitor and keep track of tested endpoints.
- Simple, easy way to keep track of unique endpoints when testing an application
- Mark individual endpoints as analyzed or not
- Instantly understand when a new endpoint, not tested is requested
- Accessible from the Proxy tab (right-click, mark the request as analyzed/not)
- Send to Repeater
- Enforcement of Burp’s in scope rules
- Import/Export state file directly to a CSV file for
- Autosave option
- Make sure you have Jython configured under Extender -> Options -> Python Environment. For further instructions, check PortSwigger official instructions at their support page.
- git clone firstname.lastname@example.org:Regala/burp-scope-monitor.git
- Import main.py in Extender – Extender -> Extensions -> Add -> Select Python -> Select main.py
Most of the options available in General or Import tabs are auto-explanatory.
- “Repeater request automatically marks as analyzed” – when issuing a request to an endpoint from the repeater, it marks this request as analyzed automatically.
- “Color request in Proxy tab” – this essentially applies the behavior of the extension in the Proxy tab, if you combine these options with “Show only highlighted items” in Proxy. However, it’s not as pleasant to the eyes as the color palette is limited.
- “Autosave periodically” – backups the state file every 10 minutes. When activating this option, consider disabling “Autostart Scope Monitor”. This is in order to maintain a different state file per Burp project. However, you can easily maintain only one, master state file.
- “Import/Export” is dedicated to handling the saved state files. It’s preferred to open your Burp project file associated with the Scope Monitor. It will still work if the Burp project is different, but when loading the saved entries, you won’t be able to send them to Repeater or view the request itself in the Request/Response viewer (this is due to the fact that we are not storing the actually requests – just the endpoint, it’s analyzed status and a couple of other more. This makes it a little bit more efficient).