We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. Please help on how to use BURP Suite to scan these webservice calls.
BURP scanning is required for any & all external web components.
To use BURP testing on an API/web service, you want to simulate API calls through BURP using SoapUI, Curl, or a similar tool.
If you don't have it already you should submit a case through you ISV partner account to get a free BURP scanner license, or go here.
Download and Install, then follow this tutorial.
This will require you to intercept and/or simulate calls to the external service via the scanner to look for vulnerabilities.