2

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. Please help on how to use BURP Suite to scan these webservice calls.

Improve this question

1 Answer 1

Reset to default
1

BURP scanning is required for any & all external web components.

To use BURP testing on an API/web service, you want to simulate API calls through BURP using SoapUI, Curl, or a similar tool.

  1. If you don't have it already you should submit a case through you ISV partner account to get a free BURP scanner license, or go here.

  2. Download and Install, then follow this tutorial.

This will require you to intercept and/or simulate calls to the external service via the scanner to look for vulnerabilities.

I usually simulate the calls to the endpoint from a tool such as Runscope.com or hurl.it, and intercept these with Burp scanner. Burp Scanner can the replay then as needed to perform the full scan.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .