4

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange.

My Managed Package is built on the Force.com platform. It does perform a couple of callouts to other applications.

I have a license and was able to launch BURP.

Here's what I have tried (based on this tutorial - http://security.force.com/security/tools/webapp/burptut ):

  • I have added login.salesforce.com to scope
  • Logging into salesforce and Spider the Org url where i have my managed package
  • Finally, I have run scanner on my Org url.

I have tried this,But the Burp Scanner aborted the scan and displayed "abandoned - too many errors".

Should I need to scan mywhole salesforce Org or Is it enough to only scan my Visualforce pages ?

And I have one more doubt. I am calling out GoogleMaps API to find location in my app. I am using this in only 3 pages in my app.

So, Is that enough to scan only those 3 pages ? And do I have to run scan on my page url or page sourcecode ?

8

I have faced exactly same problem. Salesforce does not clearly tell you what need to scan and as being SFDC developer we go and scan na1.salesforce.com. Which is not required to scan with Burp.

Your development on force.com must be scanned with Force.com Security Source Code Scanner

If you are calling out any API from force.com then you should scan those API with Burp scanner. Here is very good blog on how to do it.

Most important and confusing part is, If you are calling saleforce API (or in nut shell if you are storing SFDC credentials in 3rd party website) from any web application then you must scan your 3rd party web App using burp. This will make sure that users sales-force credentials will be stored safely

Hope this help you.

| improve this answer | |
2

Since you have a some callouts, you should be using burp scan on those callout flows. Ideally that should be enough.

As for your question, scan only your vf pages.

Also I would suggest that instead of using spider and going for active scanning, go for passive one and do manual scanning since active one takes a lot of time and scans salesforce's components instead of the one you want to cover.

| improve this answer | |
  • And I have one more doubt. I am calling out GoogleMaps API to find location in my app. I am using this in only 3 pages in my app. So, Is that enough to scan only those 3 pages ? And do I have to run scan on my page url or page sourcecode ? – Janaki Anandakumar Nov 12 '14 at 13:08
  • I ran burp scan on all my pages.. and I am getting 'Open redirection (DOM-based)' error . Can you help me to resolve this ? – Janaki Anandakumar Nov 20 '14 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.