🟠Pynt with Burp Suite

Enhance Burp Suite with Pynt for advanced API security testing. Integrate Pynt to automate and extend your security testing capabilities within Burp Suite.

What is Burp Suite?

💡 Burp Suite is a leading web vulnerability scanner used by security professionals for penetration testing of web applications. It provides tools for scanning, testing, and analyzing vulnerabilities, and supports both manual and automated security testing workflows. Burp Suite is widely used for identifying issues such as injection flaws, authentication vulnerabilities, and other security concerns in web applications.

Burp Suite

Pynt's integration with Burp Suite

As part of its API security testing, Pynt allows seamless integration with Burp.

Integrating Pynt with Burp Suite enhances your API security testing by adding automated context-aware security scans to your testing process. With Pynt, you can automate vulnerability assessments within Burp Suite, ensuring that your APIs are continuously monitored and protected against emerging threats. Pynt's integration with Burp Suite provides detailed security reports, helping you quickly identify and address critical vulnerabilities in your APIs. This powerful combination of tools enables you to maintain a secure and resilient API environment, streamline your testing workflow, and deliver secure applications with confidence.

Two ways of integrating Pynt with Burp Suite:

Run Pynt on Burp suite XML traffic output

One of the most straightforward ways to leverage Pynt for efficient API security testing with Burp Suite is by saving the web application's traffic as an XML file. This process involves capturing the traffic using Burp Suite and then exporting it to an XML format. Once you have the XML file, you can then run Pynt against this file to analyze the captured traffic for potential security issues.

To do this, follow these steps within Burp Suite:

1. Go to the **Proxy** tab and then to the **HTTP history** tab.
2. Select the traffic you are interested in analyzing.
3. Make sure that the requests are ordered correctly, Burp tend to sort by params
4. Right-click the selected traffic and choose **Save items**.
5. In the Save dialog, select Base64-encode requests and responses
6. In the Save dialog, select **XML** as the file format and choose a location to save your file.
7. Run Pynt by specifying the saved XML file as input.
Burp XML output

Basic usage

pynt burp --xml <burp_output_file.xml>

Required arguments

--captured-domains - Pynt will scan only these domains and subdomains. For all domains write "*"

Optional arguments

    --port - Set the port pynt will listen to (DEFAULT: 5001)
    --ca-path - The path to the CA file in PEM format
    --proxy-port - Set the port proxied traffic should be routed to (DEFAULT: 6666)
    --report - If present will save the generated report in this path.
    --insecure - use when target uses self signed certificates
    --host-ca - path to the CA file in PEM format to enable SSL certificate verification for pynt when running through a VPN.
    --return-error - 'all-findings' (warnings, or errors), 'errors-only', 'never' (default),

Example

Here is an example of running Pynt against XML output of traffic to goat application:

Download goat_burp.xml file and run: 

pynt burp --xml goat_burp.xml
Pynt for Burp

Use Pynt listen as an upstream proxy of Burp

Run pynt listen and set it to capture the domains of the traffic that you want Pynt to scan:

pynt listen --captured-domains <domains>

Setting Upstream Proxy in Burp Suite

To configure Burp Suite to use an upstream proxy, follow these steps:

  1. Open Burp Suite and navigate to the Proxy tab.

  2. Click on the Options sub-tab.

  3. Scroll down to the Upstream Proxy Servers section.

  4. Click on the Add button.

  5. In the dialog that appears, enter the details of the upstream proxy:

    • Destination host: Leave this as * to apply to all destinations, or specify specific hosts.

    • Proxy host: Enter the IP address of Pynt listen 127.0.0.1

    • Proxy port: Enter the port number of Pynt listen 6666

  6. Click OK to save your upstream proxy configuration.

Now, Burp Suite will route all external traffic through Pynt proxy. Hit enter to trigger Pynt scan.

💡 Pynt CLI Troubleshooting: If you're encountering issues with Pynt's CLI, visit the Pynt CLI Troubleshooting Guide for solutions and troubleshooting tips.

💡 Still Need Help? For any questions or troubleshooting, reach out to the Pynt Community Support.

PreviousPynt for JenkinsNextPynt with Browsers

Last updated