TL;DR
This guide shows you how to mark issues in Burp Suite as validated after retesting, confirming they are no longer present or pose an acceptable risk.
Validating Issues in Burp Suite
- Open the Target Site in Burp Suite: Ensure your target application is actively being tested through Burp Suite.
- Navigate to the Issue Activity Tab: In the main Burp Suite window, go to the ‘Target’ tab and select the ‘Issue activity’ sub-tab. This displays a list of identified vulnerabilities for your current scope.
- Locate the Issue to Validate: Find the specific issue you want to mark as validated. You can use filters (Severity, Confidence, Type) to narrow down the results.
- Review the Issue Details: Click on the issue to view its full details, including description, request/response information, and remediation advice. Always retest before validating!
- Mark as Validated (Manual Validation):
- Right-click on the issue in the ‘Issue activity’ tab.
- Select “Mark as validated”.
- A dialog box will appear asking for a comment. Provide a clear and concise explanation of why you are validating the issue. For example, explain how you retested it and what the results were.
- Click ‘OK’.
- Mark as Validated (Using Issue Details):
- Open the issue details page.
- Scroll down to the ‘Actions’ section.
- Click the “Validate” button.
- Again, provide a comment explaining your validation process and results.
- Click ‘OK’.
- Filtering Validated Issues: You can filter the issue list to only show validated issues by selecting ‘Status’ -> ‘Validated’ in the filters section of the ‘Issue activity’ tab. This is useful for reporting and tracking purposes.
- Understanding Validation Status: Once an issue is marked as validated, it will be excluded from future vulnerability scans unless you specifically configure Burp Suite to re-scan them (which isn’t typical).
Important Considerations
- Retesting is Crucial: Never validate an issue without thoroughly retesting it. A false validation can leave your application vulnerable.
- Clear Comments are Essential: Provide detailed comments explaining your validation process and results. This helps with audit trails and future reviews.
- Scope Awareness: Ensure you’re validating issues within the defined scope of your testing engagement.