Tools · Web testing tools · 04 / 23
Scope that includes Harbor Ledger and nothing else
Target scope is the list Burp uses to decide which hosts count. For this lab the list is one origin, http://127.0.0.1:3000. Everything the browser does besides that stays out, even when it shows up in history.
The include list is the whole scope
Open Target, then Scope. The include list should have one entry for this lab: protocol http, host 127.0.0.1, port 3000, and a file pattern that matches every path. Burp’s advanced mode shows that as a prefix or a regular expression. The plain-language version is enough if you can read it back: every URL that starts with http://127.0.0.1:3000/.
Add the entry before you browse, not after. Tools that offer “send to the scope” or “scan in-scope items” will use whatever list is there. An empty include list is not a safety net in every view. An explicit include of the lab, and no other include, is the setup these lessons assume.
Include in scope Protocol: http Host: 127.0.0.1 Port: 3000 File prefix: / Running check: http://127.0.0.1:3000/api/invoices/1042 in scope http://127.0.0.1:8080/ out of scope https://example.test/ out of scope
Rows you will see and will not include
Even a careful lab browser occasionally requests another host. A captive-portal check, an extension, or a hotlinked font will show up in history because the proxy recorded it. Recording is not the same as adopting it into scope. Leave the include list alone. If the same stray host appears on every page load, the lab page is referencing it, and the fix is in the lab app’s HTML, which you control.
Do not send a stray row to Repeater to “see what it is.” The path and the host are already visible in history. That is all you need in order to exclude it. Curiosity about a vendor host is how a lab exercise becomes traffic someone else did not agree to.
Excludes you might add on purpose
After the map is written, you can exclude http://127.0.0.1:3000/static/ so later practice stays on the documents and the API. You can exclude http://127.0.0.1:3000/logout so a careless automated pass cannot end Avery’s session and confuse the rest of the afternoon. Both excludes are on the lab host. They are workflow, not a widening of scope.
An exclude does not delete history. Clear the in-scope filter and the script row is still there, which matters when a front-end bug is the question. The DevTools lessons in this set read that script from the browser side. Burp’s copy of the same response is the server side of that story.
Worked case: prove the scope with two URLs
With the include saved, visit http://127.0.0.1:3000/health in the lab browser, then visit the invoice list. Open history and enable “Show only in-scope items.” Both lab URLs remain. If you previously saw a vendor host, it disappears from this filtered view and remains in the unfiltered view. That pair of facts is the test of the rule.
Read the include dialog once more and compare it to the address bar. Protocol, host, and port should match character for character. A trailing scope mistake that is easy to miss is an include of port 8080, which matches the proxy and not the app, so the filter goes empty and the lab looks missing. If that happens, correct the port, reload the invoice page, and look again.
Diagram
Scope is a host, a port, and a prefix
- Origin
Protocol http, host 127.0.0.1, port 3000. That is Harbor Ledger.
- Include
The include rule matches that origin and every path on it.
- Exclude
Static noise can be excluded from active work later. It is still the same host.
- Check
A history filter for in-scope items shows the lab and hides every other host.
What the scope contains
Include. No host limit, or a rule that matches every host.
History. Vendor hosts and the lab sit in one “in scope” set.
Later tools. Anything that obeys scope will treat those hosts as fair game.
Include. http://127.0.0.1:3000, all paths.
History. In-scope items are Harbor Ledger rows.
Later tools. Repeater and Logger start from the same boundary.
Include in scope Protocol: http Host: 127.0.0.1 Port: 3000 File: ^/.* Exclude from scope Host is not 127.0.0.1 Any port other than 3000
Check yourself
1. Which include rule matches Harbor Ledger as this lesson runs it?
2. History contains GET http://127.0.0.1:3000/invoices and a request to a browser vendor host. Which ones are in scope?
3. You exclude /static/.* from scope. What is still true?