Custom BCheck Scan

This repository stores some of my custom BCheck Scan configurations. Its goal is to identify intriguing elements that warrant further manual testing.

Further information on BCheck can be found at the provided link.

Repository Structure

The structure of this repository is as follows:

custom-bcheck-scan/
├── passives                   # Passive analysis on the response to identify elements worthy of further investigation. 🧬 Be careful as certain rules may trigger excessive alerts 🧬
├── common                     # Common check for misconfigurations for specific technology/framework/language
├── sensitive                  # Common check for sensitive files
├── vulnerability-classes      # Specifically targeting a particular type of vulnerability such as sqli, xss, etc.
├── testing                    # Testing scan that I'm still experimenting with
.

List of Burp Extensions that can be replace by BCheck scans in this repository

I'd like to express my gratitude to the creator of these Burp Extensions and some other open-sources tools. Their work has been instrumental in enabling my BCheck scans. While I've made every effort to recreate these extensions in BCheck, it's inevitable that mistakes may occur. If there are any areas I've overlooked, please don't hesitate to contribute and help improve them.

My BCheck Scan	Noise	Extension Name & Author
interesting-error-message	🚨	burp-suite-error-message-checks by @augustd and gf by @tomnomnom
interesting-parameters	🚨	HUNT by @jhaddix and Gf-Patterns by @1ndianl33t
open-redirect-on-param & open-redirect-on-path	-	Part of the OpenRedireX by @devanshbatham
nginx-off-by-slash	🚨	Part of the nginx off-by-slash by @bayotop and @tomnomnom
interesting-pingback-via-header & interesting-pingback-via-param	🚨	Part of the collaborator-everywhere by James Kettle
host-header-injection	-	Small part of the host_header_inchecktion by @fabianbinna
command-injection-on-param	-	Small part of the shelling by @ewilded

Kindly note that certain scans may produce excessive noise and generate numerous informational alerts post-scanning. It would be advisable to deactivate this feature by default and initiate scans only when necessary and for in-scope item only.

How to test the BCheck scan

You have two options for testing the scan:

Option 1: Import and Start Scanning

You can import all scans and begin scanning immediately.

Option 2: Inspect Each Scan Using BSCode Editor

Follow the steps below to inspect each scan using the BSCode Editor:

Open BurpSuite and navigate to Extensions -> BCheck.
Click on 'New' -> Blank.
Copy any scan into the editor.
Right-click on any request/response and select 'Send to BCheck Editor'.
Click on 'Validate' to ensure the scan is correct, then click 'Run Test' to observe how the rule runs.
"Now, you can view the details of the request in the 'Logger' tab and any identified issues in the 'Issue Activity' tab."