Burp is software that does security scanning on web applications. The goal of the software is to find security vulnerabilities. Salesforce provides partners a security scan once a year.

learn more… | top users | synonyms

0
votes
0answers
16 views

Why am I getting a Cacheable HTTPS response? [on hold]

Not sure if this is a Salesforce question, please let me know if it's not. I have a VF Page where I'm uploading a file to AWS (Amazon Web Services) S3. The form is getting submit via ajax like: ...
2
votes
1answer
39 views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
0
votes
1answer
33 views

How to BURP test our outbound msg endpoint?

We are using some workflows and trigger to send out outbound msgs to a listening end-point of ours. We are going into certification with SF and that requires some testing using BURP.. What I have read ...
2
votes
1answer
82 views

Salesforce security review process

I am planning to submit my salesforce app for security review. The app also fetches some data from an external java spring based application. The external application does not make any api call back ...
4
votes
1answer
96 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
10
votes
1answer
418 views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
1
vote
1answer
576 views

How do I run burp scanner

How do I run burp scan? Do I have to buy a burp suite? What is partner license mentioned in this url?