Issue with Burp Suite Scanner Not Sending Requests when re-scaning using Bchecks [per-host]

[ayadim]

Hi,
i have an issue with launching scan using Bchecks many time against root path : "/".

Issue:
When attempting to re-scan the root path "/" of my target web application using Burp Suite's Scanner Bchecks, I've noticed that no requests are being sent from the Burp Scanner engine. This behavior is puzzling and preventing me from effectively conducting security assessments on the root path.

Example:
if i want to check for "Exposed GIT directory" the scan pass for the first time and if i want to re-check again it send no request in logs.
what the reason that prevent burp engine to scan multi time the root path of an endpoints ?
regards

[Hannah-PortSwigger]

Hi

Could you provide your BCheck code, please?

Are you using a per-host BCheck? If so, it's likely that the host is not being rescanned as it has already run once for this host.

Could you restart Burp, then rerun the BCheck? After the restart, does it make the request again?

[ayadim]

it's only with per-host BCheck !! any solution to re-scan using pre-host scripts ?

[ayadim]

Hi
I used the default code provided by burp suite to scan exposed .git repository on the web site.

Could you provide your BCheck code, please?

metadata:
    language: v1-beta
    name: "Host-level-x"
    description: "Tests for exposed git directory"
    author: "Carlos Montoya"

run for each:
    # you could add more values to this list to make the check repeat
    potential_path =
        "/.git/config",
        "/.git/config~"

given host then
    send request called check:
        method: "GET"
        path: {potential_path}

    if "[core]" in {check.response.body} then
        report issue:
            severity: info
            confidence: certain
            detail: `Git directory found at {potential_path}.`
            remediation: "Ensure your git directories are not exposed."
    end if

Are you using a per-host BCheck?
-I just start learning how to make Bchecks scripts i guess it's per-host Bcheck since it has (given host then)).

Could you restart Burp, then rerun the BCheck? After the restart, does it make the request again?
I saved the projet and restat burp after that i scan using Bchecks and it sends 2 request but if i re-scan again for second time it does not send request, even if edit the script for example i added another path to the variable potential_path and re-scan again, it does not send requests.
potential_path = "/.git/config", "/.git/config~", "/.svn"
Regards

[Hannah-PortSwigger]

Thanks for that information! The reason that this is occurring is because a per-host check will only run once per host.

Unfortunately, at the moment, this applies to the whole project file until you close and reopen it.

We are looking at changing this behavior so that it's not as confusing. These changes should be in our next release, so hop over to the Early Adopter channel to gain access as soon as it's released.

[ayadim]

Thanks for responding, i suggest that you let user control the per-host scan in configuration library.

regards.

[ayadim]

Thanks for that information! The reason that this is occurring is because a per-host check will only run once per host.

Unfortunately, at the moment, this applies to the whole project file until you close and reopen it.

We are looking at changing this behavior so that it's not as confusing. These changes should be in our next release, so hop over to the Early Adopter channel to gain access as soon as it's released.

any update about this issue ?
ragards

[Michelle-PortSwigger]

Hi

If you check out our latest Early Adopter release (2023.10.2) we've included a fix for this.

There is some optimization, so if a specific BCheck has been run on a host and no changes have been made to it, then it won't run again, but if it has had changes then you would see it run again.

Please let me know if you have any questions.