Burp Suite, ZAP and Caido, Paired With the Engagement

Earlier this year we introduced the Burp Suite extension for sending findings from Burp into Neuron. This release replaces it with a rebuilt Burp Suite extension, and adds two siblings: a ZAP add-on and a Caido plugin. See the Burp Suite integration for everything the new extension does.

Whichever proxy your testers prefer, it now works with the engagement in both directions.

Pair Once, With a Code

Each tool pairs with one engagement the same way. Start pairing in the tool and Neuron’s Pair a tool page opens in your browser with a short code. Check that the codes match, choose the engagement, and approve.

There are no API keys to copy and paste. The pairing reaches that one engagement and nothing else, lasts 30 days, and appears under API Tokens, where it can be revoked at any time.

All three tools come from a new Tools page served by your own Neuron server. Every tool is signed, your server checks that signature when it fetches a tool and again on every download, and a new version only reaches your team once an administrator installs it. Everyone on the team runs the same version.

Send Traffic In, Without the Secrets

Select requests in the proxy and choose Send to Neuron, or press Ctrl+Shift+N. Neuron adds the hosts, web apps, endpoints and parameters they touch and stores each request with its response. Burp skips requests Neuron already has.

Before anything is stored, Neuron strips cookies, authorization headers, API keys and tokens using your library’s redaction patterns. When a finding depends on the secret itself, such as a session cookie that’s never invalidated, Send to Neuron, include sensitive values keeps it, and Neuron records that redaction was skipped.

Scope That Matches Neuron

Mark the engagement’s web apps in or out of scope in Neuron once, then choose Sync scope in the tool. Burp, ZAP and Caido each show what would change before anything is applied. In-scope web apps are added, out-of-scope ones are excluded so they can’t be scanned by accident, and conflicts are left for you to decide.

Scanner Issues Into One Triage Queue

Burp Scanner issues, ZAP alerts and Caido findings can go straight to the engagement’s Scan Issues page, on demand or automatically as the tool reports them. Neuron only accepts issues on web apps the engagement holds in scope, and false positives marked in the tool are never sent.

Sending again never undoes triage. An issue already confirmed, promoted to a finding or marked false positive keeps its content and state, and only gains paths it didn’t have. Each scan issue now shows the scanner’s own request and response evidence for every affected location.

Send Requests Back Out

Neuron is where the engagement’s requests are stored, so it’s also a good place to start the next attempt from.

• Send to Burp opens a stored request, or one from a scan issue’s evidence, in Burp Repeater. ZAP opens it in the Requester and Caido in Replay.
• Send to Burp Intruder opens an endpoint’s newest request with its parameters already marked as payload positions. ZAP opens the Fuzzer.
• Scan in Burp and Scan in ZAP start an active scan of an endpoint, after you confirm in the tool. Neuron refuses any web app marked out of scope.

Neuron never sends a secret back out. The tool fills redacted cookies and headers in from its own session, and Neuron tells you anything still redacted. Every send is recorded on the engagement’s Events timeline.

What This Means for Your Team

Testers keep the proxy they’re fastest in. Neuron keeps the record: every request, every scanner issue and every scope decision in one engagement, with secrets removed before they’re stored. And the next attempt is one click away from the evidence of the last.

The Burp Suite extension, ZAP add-on and Caido plugin are available now from the Tools page in Neuron. If you’d like to see them in action, visit neuron.ws/demo

Thanks for reading,
The PenTest.WS Development Team