Burp Suite DAST Scan (formerly known as Burp Enterprise)

Overview#

The Burp Suite DAST Scan parser processes HTML reports from Burp Suite DAST and imports the findings into DefectDojo. The parser extracts vulnerability details, severity ratings, descriptions, remediation steps, and other metadata from the HTML report.

Supported File Types#

The parser accepts a Standard Report as an HTML file. To parse an XML file instead, use the Burp XML parser.

See the Burp documentation for information on how to export a Standard Report: Burp Suite DAST Downloading reports

Standard Format HTML (Main Format)#

Total Fields in HTML#

• Total data fields in Burp Suite DAST Scan HTML output: 15
• Total data fields parsed into DefectDojo finding: 13
• Total data fields NOT parsed: 2

Standard Format Field Mapping Details#

Field Mapping Details#

The parser has different handling logic for various sections of the Burp Suite DAST report:

• For table content sections (using table_contents_xpath), the parser extracts:

  • Base endpoint from h1 elements (e.g., “https://instance.example.com”)
  • Finding titles from elements with “issue-type-row” class (e.g., “Strict transport security not enforced”)
  • Finding paths and severities from table rows
  • Combines base endpoint with path to construct full endpoints

• For vulnerability details sections (using vulnerability_list_xpath), the parser extracts:

  • Title from h2 elements
  • Various content sections based on h3 headers matching predefined categories:
    • Description headers: “issue detail”, “issue description”
    • Impact headers: “issue background”, “issue remediation”
    • Mitigation headers: “remediation detail”, “remediation background”
    • References headers: “vulnerability classifications”, “references”
    • Request/Response headers: “request”, “response”

Special Processing Notes#

Date Processing#

No special date processing is performed. The parser uses the current date for the finding.

Status Conversion#

All findings are set with default status values:

• false_p = False
• duplicate = False
• out_of_scope = False
• mitigated = None
• active = True
• verified = False

Severity Conversion#

Severity values are directly mapped from the Burp report without conversion.

Description Construction#

The description field is constructed by combining content from “issue detail” and “issue description” sections. The content is formatted with headers and the original text, including proper formatting of lists, links, and other HTML elements. The description typically begins with “Issue detail:” or “Issue description:” followed by the content, with multiple sections separated by “—” markdown dividers.

Title Format#

Finding titles are extracted directly from the h2 elements in issue containers or from table rows with the “issue-type-row” class.

Mitigation Construction#

The mitigation field is constructed by combining content from “remediation detail” and “remediation background” sections, with proper formatting.

Deduplication#

No explicit deduplication logic is implemented in the parser. DefectDojo’s standard deduplication will apply based on the hash_code generated from the finding details.

Tags Handling#

No specific tag handling is implemented in the parser.

Common settings for all findings#

All findings are set with:

• static_finding = False
• dynamic_finding = True

Unique Parser Characteristics#

This parser has special handling for different section types within the HTML report:

• It handles both the main vulnerability data in “issue-container” divs and table-based data separately
• It includes processing for evidence containers with request/response pairs
• It performs formatting of HTML content including links, lists, and other elements to maintain readable descriptions
• It extracts CWE numbers and vulnerability classifications from reference sections

Sample Scan Data#

Sample Burp Suite DAST Scan scans can be found here.

Link to Tool#

Burp Suite DAST