Image Removed

Image Added

📙 You will learn

How to install and run the ThreadFix Plugin for Burp Suite.

Prerequisites

Audience: IT Professional, or End User
Difficulty: Basic, Intermediate or Advanced
Time needed: Approximately __ minutes
Tools required: Burp Suite Application, Burp Suite Plugin

Burp Suite Application and Plugin Downloads

1. Download the latest build of Burp Suite application from http://portswigger.net/burp/
   

2. Install and launch the Burp Suite application.
   

3. In ThreadFix, click the Help icon and select Download Tools.
   

   Image RemovedImage Added

4. Download the Burp Plugin from the Download Tools page in ThreadFix.
   

Image Removed

Image Added

Install ThreadFix Plugin

From the Extender tab, within the Extensions sub-tab click the Add button.

Image RemovedImage Added

From the Load Burp Extensions modal, in the Extension file (.jar) field, select the threadfix-release-2-burp.jar file downloaded from the ThreadFix Download Tools page.

Image Removed

Image Added

A new ThreadFix Main tab will be presented with three buttons:

• Import Endpoints From Source

• Import Endpoints From ThreadFix

• Export Scan
  

Image Removed

Image Added

Import Endpoints

Please ensure that the following are set up correctly in ThreadFix before continuing.

• A Team with an Application is setup

• The Application is linked to its source code

• An API key has been created and is accessible

1. From the ThreadFix Main tab click the desired 'Import Endpoints...' button

   1. Import Endpoints From Source
      

      Image RemovedImage Added

   2. Import Endpoints From ThreadFix

      1. From the ThreadFix Options tab, enter the ThreadFix URL & API Key, the ThreadFix application from which to get endpoints, and the Target URL.

         • Add "/rest/latest" to the end of the ThreadFix URL in order for Burp to connect using the latest version of the API

         • If running ThreadFix over HTTPS, it may be necessary to import the ThreadFix server's certificate into Burp's trust store (<burp-install>/jre/lib/security)

           Image RemovedImage Added

      2. Then, from the ThreadFix Main tab, click Import Endpoints From ThreadFix

Run Spider

is this section a sub-step from the above?

1. Burp will import endpoints from the source code.
   

2. Begin the spider by choosing Spider from the Target tab. should this say ‘from the Spider tab’ instead? Based on the picture.
   

3. Burp will then begin scanning and will show its progress.
   

   Image RemovedImage Added

4. Once the scan is complete, this scan can be exported to ThreadFix.

Export Scan

1. Select the ThreadFix Main tab and click the Export Scan button.
   

2. Enter the correct URL and API key.
   

3. Choose the application for which to export a scan to ThreadFix.
   

   Image RemovedImage Added

4. A message will display informing the export succeeded.
   

   Image RemovedImage Added

5. Check ThreadFix to verify that the scan was uploaded
   

Image Removed

Image Added

Import ThreadFix Server Certificate

Burp comes packaged with it's own JRE, which is used when running the exe program. Users needing to import the ThreadFix server's certificate, in order to connect to it, should import it to <Burp Install>/jre/lib/security/cacerts.

Example command:

keytool -importcert -file /path/to/mythreadfix.cer -keystore /<burp path>/jre/lib/security/cacerts -alias tfcert

Note the ThreadFix certificate should have a SubjectAlternativeName, or there may have trouble establishing a connection. It should at least have the server's DNS name, plus its IP as a backup. For info on how to obtain the ThreadFix server's certificate, click here. Where should this direct to, there’s no link on “here”, should it be the following Adding a TLS Certificate (Kubernetes)