Once you populate the site map with information about your target, you can use the context menu to drive your workflow. To view the context menu, select an item from anywhere in the site map and right-click it.
The context menu only shows actions that are relevant to the selected item. This section describes all the possible context menu actions.
You can add or remove URLs from the target scope. Any changes you make also apply to any child branches.
This is useful if you're testing an application that includes some sensitive URLs:
You can send items to other Burp tools, such as Intruder or Organizer. This enables you to perform further attacks or analysis and use Burp to drive your workflow.
You can use the scanner to scan for content or vulnerabilities. You can scan an entire branch of a tree if you select this action from the tree view.
You can render responses in Burp's browser, to avoid the limitations of Burp's built-in HTML renderer. To render the response, paste the unique URL that Burp generates into Burp's browser.
Burp serves the resulting browser request with the exact response that you select: the request is not forwarded to the original web server. Burp's browser processes the response in the context of the originally requested URL. This means that relative links within the response are handled properly.
When Burp's browser renders the response it may make additional requests, for example for images or CSS. These are handled by Burp in the usual way.
Manually record an issue for the selected request / response pair:
Create an issue - Add a new issue.
Add to manually created issue - Add a request / response pair to a pre-existing manually created issue.
The issue is saved to your project and can be included when you generate a report.
For more information, see Manually creating issues for reports.
You can resend requests in Burp's browser:
In current browser session - Resend the request using the cookies supplied by the browser. You can use this feature to test access controls:
This method makes it much easier to deal with complex, multi-stage processes. You can simply paste a series of URLs from Burp into Burp's browser. The alternative is to repeat complicated procedures many times, and manually modify cookies with the Proxy.
The Engagement tools submenu contains useful functions that enable you to perform engagement-related tasks:
The Compare site maps function enables you to identify differences between two site maps. To learn more, see Comparing site maps.
You can use these functions to add notes or highlights to items. To learn more, see Annotations.
Use these functions in the tree view to quickly expand or collapse whole branches of the tree.
This function removes the selected items permanently. By default, the site map displays all the content that Burp identifies based on HTTP responses. This means that the map often includes a large amount of third-party content that the application links to. You can manage this in two ways:
This function copies the URLs of the selected items to the clipboard.
This function copies a curl command to the clipboard. You can use it to generate the selected request.
You can use this function to parse items for links and copy the links to the clipboard.
This function lets you save the details of your selected items as an XML file. The file includes full requests and responses, and relevant metadata such as response length, HTTP status code, and MIME type.
You can use this function to open another site map window. You can open multiple windows and configure different filters for each window.