Open

You will learn

How to install and run the ThreadFix Plugin for Burp Suite.

Prerequisites

Audience: IT Professional, or End User
Difficulty: Basic
Time needed: Approximately 5 minutes
Tools required: Burp Suite Application, Burp Suite Plugin

Burp Suite Application and Plugin Downloads

1. Download the latest build of Burp Suite application from http://portswigger.net/burp/
   
   

2. Install and launch the Burp Suite application.
   
   

3. In ThreadFix, click the Help icon and select Download Tools.
   
   

   Open

   

    

4. Download the Burp Plugin from the Download Tools page in ThreadFix.
   
   

Install ThreadFix Plugin

From the Extender tab, within the Extensions sub-tab click the Add button.

From the Load Burp Extensions modal, in the Extension file (.jar) field, select the threadfix-release-2-burp.jar file downloaded from the ThreadFix Download Tools page.

A new ThreadFix Main tab will be presented with three buttons:

• Import Endpoints From Source

• Import Endpoints From ThreadFix

• Export Scan
  
  

Import Endpoints

Please ensure that the following are set up correctly in ThreadFix before continuing.

• A Team with an Application is setup

• The Application is linked to its source code

• An API key has been created and is accessible

1. From the ThreadFix Main tab click the desired 'Import Endpoints...' button.

   1. Import Endpoints From Source
      
      

   2. Import Endpoints From ThreadFix.

      1. From the ThreadFix Options tab, enter the ThreadFix URL & API Key, the ThreadFix application from which to get endpoints, and the Target URL.

         • Add "/rest/latest" to the end of the ThreadFix URL in order for Burp to connect using the latest version of the API

         • If running ThreadFix over HTTPS, it may be necessary to import the ThreadFix server's certificate into Burp's trust store (<burp-install>/jre/lib/security)

      2. Then, from the ThreadFix Main tab, click Import Endpoints From ThreadFix.

Run Spider

1. Burp will import endpoints from the source code.
   
   

2. Begin the spider by choosing Spider from the Target tab.
   
   

3. Burp will then begin scanning and will show its progress.
   
   

    

4. Once the scan is complete, this scan can be exported to ThreadFix.

Export Scan

1. Select the ThreadFix Main tab and click the Export Scan button.
   
   

2. Enter the correct URL and API key.
   
   

3. Choose the application for which to export a scan to ThreadFix.
   
   

4. A message will display informing the export succeeded.
   
   

    

5. Check ThreadFix to verify that the scan was uploaded.
   
   

Import ThreadFix Server Certificate

Burp comes packaged with it's own JRE, which is used when running the exe program. Users needing to import the ThreadFix server's certificate, in order to connect to it, should import it to <Burp Install>/jre/lib/security/cacerts.

Example command:

keytool -importcert -file /path/to/mythreadfix.cer -keystore /<burp path>/jre/lib/security/cacerts -alias tfcert

Note the ThreadFix certificate should have a SubjectAlternativeName, or there may have trouble establishing a connection. It should at least have the server's DNS name, plus its IP as a backup.