Skip to content

Commit a403927

Browse files
skywalke34skywalke34
authored
Update Burp Enterprise HTML Parser Documentation (#12407)
Update the Burp Enterprise html parser including field mapping and conversion details.
1 parent 1884ada commit a403927

File tree

1 file changed

+99
-5
lines changed

1 file changed

+99
-5
lines changed

‎docs/content/en/connecting_your_tools/parsers/file/burp_enterprise.md

Lines changed: 99 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,105 @@ title: "Burp Enterprise Scan"
33
toc_hide: true
44
---
55

6-
### File Types
7-
DefectDojo parser accepts a Standard Report as an HTML file. To parse an XML file instead, use this method: https://documentation.defectdojo.com/integrations/parsers/file/burp/
6+
## Overview
7+
The Burp Enterprise Scan parser processes HTML reports from Burp Enterprise Edition and imports the findings into DefectDojo. The parser extracts vulnerability details, severity ratings, descriptions, remediation steps, and other metadata from the HTML report.
88

9-
See also Burp documentation for info on how to export a Standard Report:
10-
https://portswigger.net/burp/documentation/enterprise/work-with-scan-results/generate-reports
9+
## Supported File Types
10+
The parser accepts a Standard Report as an HTML file. To parse an XML file instead, use the [Burp XML parser](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/burp/).
11+
12+
See the Burp documentation for information on how to export a Standard Report: [PortSwigger Enterprise Edition Downloading reports](https://portswigger.net/burp/documentation/enterprise/work-with-scan-results/generate-reports)
13+
14+
## Standard Format HTML (Main Format)
15+
16+
### Total Fields in HTML
17+
- Total data fields in Burp Enterprise Scan HTML output: 15
18+
- Total data fields parsed into DefectDojo finding: 13
19+
- Total data fields NOT parsed: 2
20+
21+
### Standard Format Field Mapping Details
22+
23+
| Data Field # | Burp Enterprise Scan Data Field | DefectDojo Finding Field | Parser Line # | Notes |
24+
|-------------|--------------------------------|--------------------------|--------------|-------|
25+
| 1 | Title | title | 101, 165 | Extracted from issue container h2 element and table rows with "issue-type-row" class |
26+
| 2 | Severity | severity | 101, 168 | Extracted from table rows, mapped directly (High/Medium/Low/Info) |
27+
| 3 | Issue Detail | description | 124-135 | Extracted from matching header "issue detail" and formatted with header |
28+
| 4 | Issue Description | description | 124-135 | Extracted from matching header "issue description" and formatted with header |
29+
| 5 | Issue Background | impact | 136-139 | Extracted from matching header "issue background" and formatted with header |
30+
| 6 | Issue Remediation | impact | 136-139 | Extracted from matching header "issue remediation" and formatted with header |
31+
| 7 | Remediation Detail | mitigation | 140-143 | Extracted from matching header "remediation detail" and formatted with header |
32+
| 8 | Remediation Background | mitigation | 140-143 | Extracted from matching header "remediation background" and formatted with header |
33+
| 9 | References | references | 144-152 | Extracted from matching header "references" and formatted with links |
34+
| 10 | Vulnerability Classifications | references, cwe | 144-157 | Extracts vulnerability IDs (including CWE numbers) and adds to references section |
35+
| 11 | Request | request_response | 124-135, 190-195 | Stored as request part of request/response pair in evidence container |
36+
| 12 | Response | request_response | 124-135, 190-195 | Stored as response part of request/response pair in evidence container |
37+
| 13 | Endpoint URL | endpoints | 88-101 | Combined from base URL (e.g., "https://instance.example.com") and path (e.g., "/fe/m3/m-login") |
38+
| 14 | Confidence Level | Not Parsed | - | Shown in HTML report (Certain/Firm/Tentative) but not extracted to findings |
39+
| 15 | Issue ID/Anchor | Not Parsed | - | HTML anchor tags like "#7459896704422157312" are not extracted |
40+
41+
### Field Mapping Details
42+
The parser has different handling logic for various sections of the Burp Enterprise report:
43+
44+
- For table content sections (using `table_contents_xpath`), the parser extracts:
45+
- Base endpoint from h1 elements (e.g., "https://instance.example.com")
46+
- Finding titles from elements with "issue-type-row" class (e.g., "Strict transport security not enforced")
47+
- Finding paths and severities from table rows
48+
- Combines base endpoint with path to construct full endpoints
49+
50+
- For vulnerability details sections (using `vulnerability_list_xpath`), the parser extracts:
51+
- Title from h2 elements
52+
- Various content sections based on h3 headers matching predefined categories:
53+
- Description headers: "issue detail", "issue description"
54+
- Impact headers: "issue background", "issue remediation"
55+
- Mitigation headers: "remediation detail", "remediation background"
56+
- References headers: "vulnerability classifications", "references"
57+
- Request/Response headers: "request", "response"
58+
59+
### Special Processing Notes
60+
61+
#### Date Processing
62+
No special date processing is performed. The parser uses the current date for the finding.
63+
64+
#### Status Conversion
65+
All findings are set with default status values:
66+
- `false_p = False`
67+
- `duplicate = False`
68+
- `out_of_scope = False`
69+
- `mitigated = None`
70+
- `active = True`
71+
- `verified = False`
72+
73+
#### Severity Conversion
74+
Severity values are directly mapped from the Burp report without conversion.
75+
76+
#### Description Construction
77+
The description field is constructed by combining content from "issue detail" and "issue description" sections. The content is formatted with headers and the original text, including proper formatting of lists, links, and other HTML elements. The description typically begins with "**Issue detail**:" or "**Issue description**:" followed by the content, with multiple sections separated by "---" markdown dividers.
78+
79+
#### Title Format
80+
Finding titles are extracted directly from the h2 elements in issue containers or from table rows with the "issue-type-row" class.
81+
82+
#### Mitigation Construction
83+
The mitigation field is constructed by combining content from "remediation detail" and "remediation background" sections, with proper formatting.
84+
85+
#### Deduplication
86+
No explicit deduplication logic is implemented in the parser. DefectDojo's standard deduplication will apply based on the hash_code generated from the finding details.
87+
88+
#### Tags Handling
89+
No specific tag handling is implemented in the parser.
90+
91+
#### Common settings for all findings
92+
All findings are set with:
93+
- `static_finding = False`
94+
- `dynamic_finding = True`
95+
96+
## Unique Parser Characteristics
97+
This parser has special handling for different section types within the HTML report:
98+
- It handles both the main vulnerability data in "issue-container" divs and table-based data separately
99+
- It includes processing for evidence containers with request/response pairs
100+
- It performs formatting of HTML content including links, lists, and other elements to maintain readable descriptions
101+
- It extracts CWE numbers and vulnerability classifications from reference sections
11102

12103
### Sample Scan Data
13-
Sample Burp Enterprise Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/burp_enterprise).
104+
Sample Burp Enterprise Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/burp_enterprise).
105+
106+
### Link to Tool
107+
[Burp Enterprise Edition](https://portswigger.net/burp/enterprise)

0 commit comments

Comments
 (0)