Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange.
My Managed Package is built on the Force.com platform. It does perform a couple of callouts to other applications (iPad app, web app). I'm surprised that the Force.com security scanner isn't enough, but anyway...
I have a license and was able to launch BURP. However, I have no idea how to "scan my managed package".
Here's what I have tried (based on tutorials mainly):
- In Spider -> Options, set the application login credentials for my package org.
- In Repeater -> Request -> Raw, set the following
GET / HTTP/1.1 Host: na12.salesforce.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close
Following this, I right-clicked and selected "Add to Site Map"
- In Target -> Scope, added a Scope. Set Host/IP Range regex as ^na12$ with Port ^443$ (I have also tried na12.salesforce.com, but I realized that wouldn't cover the "visual.force.com" pages)
At some point it did seem to be scanning Salesforce, but not my managed package; just pages like the Forgot Password page, and other system files. Salesforce themselves have been extremely unhelpful and won't provide any further info.
I realize this isn't a true Salesforce question, but I'm sure other developers have been asked/will be asked to do this during the submission process for AppExchange and I could do with some help.