ActiveScan++

ActiveScan++ extends Burp Suite's active and passive scanning capabilities. Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers:

• Potential host header attacks (password reset poisoning, cache poisoning, DNS rebinding)
• Edge Side Includes
• XML input handling
• Suspicious input transformation (eg 7*7 => '49', \\ => '\' )
• Passive-scanner issues that only occur during fuzzing (install the 'Error Message Checks' extension for maximum effectiveness)

It also adds checks for the following issues:

• Blind code injection via expression language, Ruby's open() and Perl's open()
• CVE-2014-6271/CVE-2014-6278 'shellshock' and CVE-2015-2080, CVE-2017-5638, CVE-2017-12629, CVE-2018-11776, etc

Requirements:

Burp Suite Professional or Enterprise (latest stable version)

Manual installation:

1. 'Extensions'->'Installed'->'Add
2. Click 'Select file'
3. Choose build/libs/active-scan-plus-plus-all.jar

Usage notes:

To invoke these checks, just run a normal active scan.

Changelog:

2.0.0 20241202

• Rewrite in Java!

1.0.24 20230801

• Devise (no CVE, refer to Smashing the State Machine)

1.0.23 20211210

• Log4Shell (CVE-2021-44228)

1.0.22 20210325

• Detect interesting OAuth endpoints.
• For further details, please refer to Hidden OAuth Attack Vectors

1.0.21 20190322

• Detect Rails file disclosure (CVE-2019-5418)

1.0.20 20180903

• Detect new Struts RCE (CVE-2018-11776)

1.0.19 20180815

• Detect Razor template injection with @(7*7)

1.0.18 20180804

• Try converting requests to XML for XXE
• Detect CVE-2017-12611, CVE-2017-9805
• Improve robustness

1.0.17 20180411

• Detect interesting files: /.git/config and /server-status
• This can be easily extended with your own checks

1.0.16 20180404

• Detect Edge Side Includes

1.0.15 20171026

• Detect RCE via Solr/Lucene injection using XXE - CVE-2017-12629

1.0.14 20170309

• Detect the latest Struts2 RCE - CVE-2017-5638 / S2-045

1.0.13 20160411

• Detect shell command injection via Perl open() calls
• Fix bug that reduced efficiency by creating useless insertion points
• Sadly remove the 'NullPointerException' feature
• Fix bug that caused passive scanner issues to appear on HTTP instead of HTTPS
• Reduce time-delay based check false positives

1.0.12 - 20151118

• Trigger a fresh passive scan when an alternative code path is identified (combines well with the 'Error Message Checks' extension)

1.0.11 - 20150327

• Detect misc code injection via suspicious input transformation (eg \x41->A)
• Report when applications appear to handle XML input
• Set Connection: close on outgoing requests for speed

1.0.10 - 20150327

• Add test for ruby open() exploit - see http://sakurity.com/blog/2015/02/28/openuri.html
• Assorted minor tweaks and fixes

1.0.9 - 20150225

• Add tentative test for CVE-2015-2080
• Remove dynamic code injection and RPO checks - these are now implemented in core Burp
• Provide a useful error message when someone foolishly tries using Jython 2.7 beta

1.0.8 - 20141001

• Add tentative test for CVE-2014-6278

1.0.7 - 20140926

• Tweak test for CVE-2014-6271 for better coverage

1.0.6 - 20140925

• Add a test for CVE-2014-6271

1.0.5 - 20140708

• Add compatibility for Jython 2.5 (stable)
• Improve cache poisoning detection
• Add a cachebust parameter to prevent accidental cache poisoning
• Misc. bugfixes

1.0.4 - 20140616

• Prevent RPO false positives by checking page's DOCTYPE
• Reduce host header poisoning false negatives

1.0.3 - 20140523

• Prevent duplicate issues when saving/restoring state
• Refactor: the passive scanner is now almost extensible
• Improve expression language injection detection
• Improve RPO regex

1.0.2 - 20140424

• Thread safety related bugfixes

1.0.1 - 20140422

• Minor bugfixes

1.0:

• Release