3 ms·
So is it "fix whatever Burp points out" ? Is that a good first step ? Especially for api endpoints (versus websites)
by sandGorgon 9y ago
So is it "fix whatever Burp points out" ?
Is that a good first step ? Especially for api endpoints (versus websites)
- tptacek 9y agoYou'd ideally want a dev process where all your developers were capable of conducting integration test runs with Burp; you'd probably set up a checklist of authz tests, and set up some custom wordlists for Intruder for database, filesystem, and DOM injection vectors.
- sandGorgon 9y agoThanks. This was a superuseful suggestion. I can now Google a lot of stuff on my own.