Skip to main content

Questions tagged [burp]

Burp is software that does security scanning on web applications. The goal of the software is to find security vulnerabilities. Salesforce provides partners a security scan once a year.

Filter by
Sorted by
Tagged with
3 votes
0 answers
434 views

Why & How to use Burp Suite for Salesforce External Services

I am investigating the possibility of using Burp as an alternative to Chimera or OWASP Zap to provide a scan report of an External Service in the Salesforce Security Review. The information that I am ...
Manuel Moya's user avatar
1 vote
1 answer
186 views

Scan report for custom REST service for security review. Is that mandatory?

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...
Bforce's user avatar
  • 6,828
3 votes
0 answers
126 views

Burp Scanner-License Issue. Experts suggestions please

We are planning to submit our app in AppExchange. We have succeeded in generating ZAP but we were also asked to submit BURP Scanner report. But the issue with Burp is that, the professional edition ...
Priyalakshmi's user avatar
  • 1,456
2 votes
2 answers
326 views

Managed Packaged Appication Help (Zap Scanner)

I am doing apex rest callout to third party web service but when I ran zap scanner using SOAP UI, it gave me results which are specific to client side but not on server end like xframe options etc. ...
Piyush's user avatar
  • 153
4 votes
3 answers
2k views

Security review sample "False positive document"

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
dsr's user avatar
  • 141
7 votes
1 answer
4k views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
Krishna's user avatar
  • 73
2 votes
1 answer
1k views

Burp suite rest webservice callout

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. ...
Rajeev Kumar Singh's user avatar
3 votes
2 answers
460 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
Krishna Bidwai's user avatar
2 votes
1 answer
309 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
Krishna Bidwai's user avatar
4 votes
1 answer
139 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
James's user avatar
  • 193
3 votes
1 answer
759 views

How to run Burp web scanner for HTTP Callout?

I have submitted app for security review and they asked for Burp Scan Report. I have followed video tutorial but not get succeeded. Burp Scanner scan salesforce site instead of my HTTP Callout. ...
Mahek's user avatar
  • 71
4 votes
2 answers
2k views

Burp Scanner in Salesforce

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
Janaki Anandakumar's user avatar
4 votes
1 answer
1k views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
Ankur Bhargava's user avatar
1 vote
2 answers
2k views

How to BURP test our outbound message endpoint?

We are using some workflows and trigger to send out outbound messages to a listening end-point of ours. We are going into a security review with SF and that requires some testing using BURP. What I ...
auny's user avatar
  • 773
2 votes
2 answers
436 views

Salesforce security review process

I am planning to submit my salesforce app for security review. The app also fetches some data from an external java spring based application. The external application does not make any api call back ...
Sandeep Chopra's user avatar
6 votes
1 answer
658 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
Keith C's user avatar
  • 136k
12 votes
1 answer
1k views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
George S.'s user avatar
  • 2,740
1 vote
1 answer
1k views

How do I run burp scanner

How do I run burp scan? Do I have to buy a burp suite? What is partner license mentioned in this url?
Bhushan Lodha's user avatar