Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I have submitted app for security review and they asked for Burp Scan Report. I have followed video tutorial but not get succeeded. Burp Scanner scan salesforce site instead of my HTTP Callout.
Actually I am calling HTTP Callout in Insert/Update Trigger.
So Anyone suggest how to run Burp Scanner for HTTP Callout and generate report so I can submit it to Security Review.
A callout in your apex code will go from the Salesforce instance to the endpoint and will not be routed through your browser, therefore setting your browser proxy to be Burp will not catch the endpoint.
Rather, assuming that you tested this endpoint with some client -- even if the client is just curl commands, set the test client to use burp as a proxy (e.g. curl accepts a --proxy or -X switch) and run your tests of the endpoint through Burp. Then configure burp to perform an active scan. You should also explicitly set the target scope in Burp to be the endpoint and not your Salesforce instance. You may want to set Burp to use REST style URL parameters (http://portswigger.net/burp/help/scanner_options.html)
