Scoping Your Target
Being a Security Professional, scope is a common term which we need to deal with. Most times, we are asked to test a limited part of our Application and hence many times the scope is limited to domains,subdomains,folder name and files names Here I am using Juice Shop Vulnerable Application as my target, to downlaod OWASP Juice Shop just refer to below link Juice Shop Link
- Open OWASP Juice Shop in your favorite Browser and turn on Foxy Proxy switcher.
Now go to Burp Suite and turn on intercept mode, you will get the intercept request of Juice shop when you refresh your browser.
(1)Intercept Request of OWASP Juice Shop
(2)Now go to Target Tab and you will find the list of Target available many of which are not specific to our Pentesting Scope. So lets clean the out of scope targets.
(3)By clicking add to scope. We will tell Burp that our target application is this.
(4)Now click on filter tab above the sitemap to remove target which are not in our interst.
(5)Now check the show only in-scope items option to filter target list
(6)Now you will see that we have only our scope item in list, using these techniques makes you more Professional and shows your proper way of doing pentesting
Inclusion versus Exclusion
Now there are times when your client ask you to test an Application but limits your scope to some directories or even there can be some functionality in the Application which may trigger automated emails to users of website. In such cases we should explicitly define those URLs in the exclusion list. To do so follow below screenshots:
- First of all, Intercept your target and after doing some mannual spidering if you encounter logout page and dont want to get logged out while doing different tests and want it to put in exclusion list, then simply copy url as shown below.
- Now navigate to Target and then to subtab Scope.There you can direclty paste Url in the exclusion list and it will get pasted there.
