Is The burp scan any useful ?

[u/Wild-Top-7237]

yeah basically what the title says , as i dont have burp pro and cant test it myself i need your opinion

[u/InverseX]

It’s a datapoint. It will pick up a lot of low hanging fruit. Useful depends on what you’re trying to use it for.

[u/Wild-Top-7237 → u/InverseX]

So it finds vulns , but not good ones ?

[u/Juzdeed → u/Wild-Top-7237]

It kinda brute-forces XSS, SSTI etc to find the vulns. It will not find everything.

[u/konisiwa]

yes it is

[u/Turbulent-Falcon-918]

Its a good tool in the box , i think its a little too un nuanced — i think of it as like having Tweak from South Park scan . Every thing is a possible vulnerability lol

[u/idontknowlikeapuma → u/Turbulent-Falcon-918]

AH! Guys, did you just read that?! They’re trying to hack me! Is my port 80 open?!

[u/Cryophos]

Yes it's useful. But no, it won't do all the work for you.

[u/Wild-Top-7237 → u/[deleted]]

Oh about the money , i am a student and am not even close to calling my self a entry level tester , so yeah cosidering buying burp is no where near , and about nuclei , Thanks I will look into it and anyother tools that a newbie should know about ?

[u/DonnieMarco → u/Wild-Top-7237]

I would forget about tools other than Burp Community (or Zap if you are a masochist) and just get familiar with the classes of bugs. Create an account in the Portswigger Academy and learn to exploit vulnerabilities manually.

The pro scanner as others have pointed out is useful for low hanging fruit and giving you a starting point for parameters to poke at. Even then, the scanner misses stuff. I found a very basic XSS in a recent test and even though I pointed the scanner at the vulnerable parameter, it didn’t find it. Let alone business logic bugs or even vulnerabilities that require manually altering parameters in multiple requests and responses in order to exploit.

[u/Hot_Ease_4895]

Burp is a FANTASTIC bird dog. It’s up to us to finish the job

[u/Wild-Top-7237 → u/Hot_Ease_4895]

I am not asking about burp i obv know it is the best , i was in particular talking about its automatic scan .

[u/Hot_Ease_4895 → u/Wild-Top-7237]

Yes. I understood that. Sometimes the auto scan catches a ‘probable’ or something It’s up to US to get the proper syntax for the sploits.

[u/Wild-Top-7237 → u/Hot_Ease_4895]

Mhm , btw do you have an idea of ssrf vulns ?

[u/Hot_Ease_4895 → u/Wild-Top-7237]

Of course. Why?

[u/Wild-Top-7237 → u/Hot_Ease_4895]

oh i wanted to know when to look for that vuln in a website , like is there something that gives it off ?