You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/How to Use BurpSuite with Faction.md
+8-1Lines changed: 8 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,7 @@ You can install the Faction Integration directly from the BApp store.
15
15
1. Open Burp then Click Extensions->BApp Store
16
16
3. Search for Faction
17
17
4. Click Install
18
+
18
19
19
20
20
21
## Set Up Faction
@@ -29,24 +30,29 @@ You can retrieve your API Key in Faction by accessing your profile in the upper
29
30
30
31
## Access Your Assessment Queue
31
32
Now that Faction is configured you should be able to see you current assessment queue as shown below:
33
+
32
34
33
35
34
36
Clicking on an assessment will show you the scope, any vulnerabilities that have been reported, and notes that your team has shared with you.
37
+
35
38
36
39
37
40
If you select one of the vulnerabilities you can see its full details including screenshots.
41
+
38
42
39
43
40
44
## Enter Findings into Faction From Burp
41
45
42
46
Lets say you find an XSS attack and have verified it with BurpSuite. You can add the finding to Faction without ever leaving Burp. Just select the request or response that you want to enter into the report and select "Add New Finding" as shown below:
47
+
43
48
44
49
45
50
Now you will be presented with the vulnerability findings dialog. Here you can search for an existing vulnerability template to auto populate the details and recommendations.
46
51
47
-
Next ensure its being sent to the right assessment. The option will default to the last assessment you selected in the previous section on [Access your Assessment Queue](#Access%20Your%20Assessment%20Queue)
52
+
Next ensure its being sent to the right assessment. The option will default to the last assessment you selected in the previous section on [Access your Assessment Queue](#access-your-assessment-queue)
48
53
49
54
Next you have several options.
55
+
50
56
- Select the severity or leave the default
51
57
- Check or uncheck to include the request and/or response. When checked it will include these options in code blocks in the final report.
52
58
- "Snip cookies" when checked will remove all cookies from being added to the report and replace them with `[...snip...]`
@@ -75,6 +81,7 @@ Anything found in the BurpSuite Scanner can be added directly into Faction using
75
81
76
82
77
83
Below shows that all issues were combined into two distinct issues.
84
+
78
85
79
86
80
87
Notice that if you select more than one of the same issue that it will aggregate the URLs into one finding:
<p>In BurpSuite navigate to the Faction tab after you have installed the Faction Integration. From here you need to enter the URL and API key for your user. </p>
1021
1021
<p>The URL will be your domain plus <code>api</code>. Ex <code>https://faction-test.factionsecurity.com/api</code></p>
<h2id="enter-findings-into-faction-from-burp">Enter Findings into Faction From Burp</h2>
1033
-
<p>Lets say you find an XSS attack and have verified it with BurpSuite. You can add the finding to Faction without ever leaving Burp. Just select the request or response that you want to enter into the report and select "Add New Finding" as shown below:
<p>Lets say you find an XSS attack and have verified it with BurpSuite. You can add the finding to Faction without ever leaving Burp. Just select the request or response that you want to enter into the report and select "Add New Finding" as shown below:</p>
<p>Now you will be presented with the vulnerability findings dialog. Here you can search for an existing vulnerability template to auto populate the details and recommendations. </p>
1036
-
<p>Next ensure its being sent to the right assessment. The option will default to the last assessment you selected in the previous section on <ahref="#Access%20Your%20Assessment%20Queue">Access your Assessment Queue</a></p>
1037
-
<p>Next you have several options.
1038
-
- Select the severity or leave the default
1039
-
- Check or uncheck to include the request and/or response. When checked it will include these options in code blocks in the final report.
1040
-
- "Snip cookies" when checked will remove all cookies from being added to the report and replace them with <code>[...snip...]</code>
1041
-
- "Extract Selection" when checked will only add the portion of the code you selected in Burp to the report. This is most useful trying to only show the reflected script in the response instead of the full response.
1042
-
- Exploit Steps can be included and supports MarkDown Syntax. <em>Note Screenshots are available though the Burp Extension currently. For this you still need to add them to the Web UI.</em></p>
1036
+
<p>Next ensure its being sent to the right assessment. The option will default to the last assessment you selected in the previous section on <ahref="#access-your-assessment-queue">Access your Assessment Queue</a></p>
1037
+
<p>Next you have several options. </p>
1038
+
<ul>
1039
+
<li>Select the severity or leave the default</li>
1040
+
<li>Check or uncheck to include the request and/or response. When checked it will include these options in code blocks in the final report.</li>
1041
+
<li>"Snip cookies" when checked will remove all cookies from being added to the report and replace them with <code>[...snip...]</code></li>
1042
+
<li>"Extract Selection" when checked will only add the portion of the code you selected in Burp to the report. This is most useful trying to only show the reflected script in the response instead of the full response. </li>
1043
+
<li>Exploit Steps can be included and supports MarkDown Syntax. <em>Note Screenshots are available though the Burp Extension currently. For this you still need to add them to the Web UI.</em></li>
<p>Now you can click <strong>Save</strong> to add it to Faction. All this allows issues to be added seamlessly without breaking your flow. The final result will look something like this.</p>
<p>Anything found in the BurpSuite Scanner can be added directly into Faction using the BurpSuite Integration as well. Just select the issues you want to add and then choose "Send Issues to Faction"</p>
0 commit comments