> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/simplevulnerabilitymanager/svm/llms.txt
> Use this file to discover all available pages before exploring further.

# Burp Suite Scanner Script

> Documentation for burpsuite_scan.bat automated scanning with Carbonator extension

Automated Burp Suite scanning script using the Carbonator extension for headless operation.

## Overview

The `burpsuite_scan.bat` script launches Burp Suite Professional with the Carbonator extension to perform automated vulnerability scans. Carbonator enables headless scanning and spider automation.

### Carbonator Extension

Carbonator is a Burp Suite extension that provides:

* Headless scanning capabilities
* Automated spider and scan
* Command-line driven operation

**Extension URL**: [https://www.integrissecurity.com/index.php?resources=Carbonator](https://www.integrissecurity.com/index.php?resources=Carbonator)

## Parameters

| Parameter   | Position | Description                                  |
| ----------- | -------- | -------------------------------------------- |
| `burpsuite` | 1        | Path to Burp Suite executable (.jar or .exe) |
| `scheme`    | 2        | URL scheme (http or https)                   |
| `fqdn`      | 3        | Fully qualified domain name or IP address    |
| `port`      | 4        | Target port number                           |
| `folder`    | 5        | Target folder/path on the server             |

## Usage

### Using JAR File

```batch theme={null}
burpsuite_scan.bat "C:\Tools\burpsuite_pro.jar" "https" "example.com" "443" "app"
```

This executes:

```batch theme={null}
java -jar -Xmx2g C:\Tools\burpsuite_pro.jar https example.com 443 app
```

### Using EXE File

```batch theme={null}
burpsuite_scan.bat "C:\Program Files\BurpSuite\burpsuite.exe" "http" "testsite.local" "80" "/"
```

This executes:

```batch theme={null}
C:\Program Files\BurpSuite\burpsuite.exe http testsite.local 80 /
```

## Script Behavior

### JAR Execution

When the burpsuite parameter ends with `.jar`:

* Launches Java with 2GB heap memory (`-Xmx2g`)
* Passes scheme, FQDN, port, and folder as arguments to Carbonator

```batch theme={null}
java -jar -Xmx2g %burpsuite% %scheme% %fqdn% %port% %folder%
```

### EXE Execution

When the burpsuite parameter ends with `.exe`:

* Launches the executable directly
* Passes the same arguments

```batch theme={null}
%burpsuite% %scheme% %fqdn% %port% %folder%
```

## Example Scan Scenarios

### HTTPS Web Application

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "https" "webapp.company.com" "443" "admin"
```

Scans: `https://webapp.company.com:443/admin`

### HTTP Application on Custom Port

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "http" "192.168.1.100" "8080" "api/v1"
```

Scans: `http://192.168.1.100:8080/api/v1`

### Root Path Scan

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "https" "example.com" "443" "/"
```

Scans: `https://example.com:443/`

## Prerequisites

<Note>
  * **Burp Suite Professional** with valid license (Carbonator requires Pro)
  * **Java Runtime Environment** (JRE) for .jar execution
  * **Carbonator extension** installed in Burp Suite
  * Sufficient memory (script allocates 2GB heap)
</Note>

### Installing Carbonator

1. Download Carbonator from [https://www.integrissecurity.com/index.php?resources=Carbonator](https://www.integrissecurity.com/index.php?resources=Carbonator)
2. In Burp Suite, go to **Extender** > **Extensions**
3. Click **Add** and select the Carbonator .jar file
4. Configure Carbonator settings for automated scanning

## Configuration Notes

### Memory Allocation

The script uses `-Xmx2g` to allocate 2GB of heap memory. For larger scans, modify this value:

```batch theme={null}
rem Increase to 4GB for large applications
java -jar -Xmx4g %burpsuite% %scheme% %fqdn% %port% %folder%
```

### Headless Mode (Commented Out)

The script includes a commented-out headless mode option:

```batch theme={null}
rem java -jar -Xmx2g %burpsuite% -Djava.awt.headless=true %scheme% %fqdn% %port% /%folder%
```

To enable true headless operation, uncomment this line at burpsuite\_scan.bat:18.

## Limitations

<Warning>
  * Requires Burp Suite Professional (Community edition does not support scanning)
  * Carbonator must be pre-configured within Burp Suite before running the script
  * The script does not configure proxy settings or authentication
  * No output file path is specified - reports must be configured in Carbonator settings
</Warning>

## Troubleshooting

### Java Not Found

If Java is not in the system PATH:

```batch theme={null}
"C:\Program Files\Java\jdk-11\bin\java.exe" -jar -Xmx2g burpsuite_pro.jar ...
```

### Insufficient Memory

If scans fail with OutOfMemoryError:

* Increase heap size: `-Xmx4g` or `-Xmx8g`
* Close other applications to free system memory

### Carbonator Not Running

Ensure Carbonator is:

* Installed in Burp Suite Extender
* Enabled and not showing errors
* Configured with appropriate scan settings