Setting the initial test scope in Burp Suite

By default, as you use Burp's browser, Burp logs all HTTP or WebSocket messages for further analysis. By setting a scope, you can tell Burp which URLs you want to test and which you don't want to test. For example, you may want to exclude URLs that:

• You don't have permission to test.
• Aren't safe to test. For example, URLs that contain potentially dangerous functionality.
• Aren't relevant. Once you have set the scope, you can use the filters in the Target site map and Proxy history to screen out some of the noise.

Adding URLs to the scope

To add a URL to your scope:

1. Click Scope settings on the lower toolbar to open the Settings dialog.
2. Scroll to the Target scope setting.
3. Under Include in scope, click Add. The Add prefix for in-scope URLs dialog opens.
4. Enter the prefix for the URLs that you want to match, then click OK.
5. When prompted, choose whether to stop logging out-of-scope traffic. This can provide performance benefits.

The prefix is added to the Include in scope list. Any URL that starts with this exact prefix is now in scope. Any URL that doesn't start with a prefix from the list is out of scope. For example, if you add https://example.com, requests to any path on this domain are in scope if they're accessed over HTTPS.

Excluding URLs from the scope

After you add a URL to your scope, you may want to exclude specific paths that are a subset of the in-scope prefixes, such as https://example.com/admin. To exclude a URL from your scope:

1. Click Scope settings on the lower toolbar to open the Settings dialog.
2. Scroll to the Target scope setting.
3. Under Exclude from scope, click Add. The Add prefix for out-of-scope URLs dialog opens.
4. Enter a prefix for the URLs that you want to exclude, then click OK.

The prefix is added to the Exclude from scope list. A URL is now in scope if it starts with an in-scope prefix, but does not start with an out-of-scope prefix.