CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/burp-headless

Configures and runs headless Burp Suite Professional / Enterprise vulnerability scans (a "Burp scan"): Pro drives scans via its local REST API, Enterprise runs CI-driven scans at scale via its server API; supports BApp Store extensions (BCheck, custom scanners) and authenticated targets via session-handling rules; exports issues as HTML / XML / CSV / JSON or SARIF. Use when the team has a Burp Suite license and wants to run a vulnerability scan with Burp - paid-tier dynamic application security testing (DAST) layered on top of OWASP ZAP.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

enterprise-ci.mdreferences/

Burp Enterprise CI integration

Burp Enterprise (CI-friendly) workflow:

  1. Enterprise server stores scan configurations + targets.
  2. CI script triggers a scan via the Enterprise REST API.
  3. CI script polls for completion + downloads issues as JSON.
  4. CI script parses + gates per severity.

The full CI-driven scanning model is documented per automated scanning "CI-driven scanning"; consult portswigger.net/burp/documentation/enterprise for current API endpoints (the surface is stable but per-version specifics evolve).

GitHub Actions workflow (Enterprise model)

jobs:
  burp-enterprise:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Burp Enterprise scan
        run: |
          SCAN_ID=$(curl -s -X POST "${{ secrets.BURP_ENT_URL }}/api/scans" \
            -H "Authorization: ${{ secrets.BURP_ENT_TOKEN }}" \
            -d '{"site_id":42,"scan_configuration_id":7}' \
            | jq -r '.id')
          echo "SCAN_ID=$SCAN_ID" >> $GITHUB_ENV
      - name: Wait for scan completion
        run: |
          while true; do
            STATUS=$(curl -s "${{ secrets.BURP_ENT_URL }}/api/scans/$SCAN_ID" \
              -H "Authorization: ${{ secrets.BURP_ENT_TOKEN }}" | jq -r '.status')
            [ "$STATUS" = "succeeded" ] && break
            [ "$STATUS" = "failed" ] && exit 1
            sleep 30
          done
      - name: Download issues
        run: curl -s "${{ secrets.BURP_ENT_URL }}/api/scans/$SCAN_ID/issues" \
            -H "Authorization: ${{ secrets.BURP_ENT_TOKEN }}" -o burp-issues.json

references

enterprise-ci.md

SKILL.md

tile.json