difference between "LEGACY_PASSIVE_AUDIT_CHECKS" and "live passive audit"

[petrabrunner]

Hi all,
I want to start a "passive audit" of sitemap items via the montoya-api.
After implementing this my team noticed that there is a difference in the findings between the following two scenarios:

1. if I actually browse to a url and have burp "live audit" run in the background (see screenshot)
2. and if I start the scan via the montoya-api like this:
   scanner().startAudit(AuditConfiguration.auditConfiguration(BuiltInAuditConfiguration.LEGACY_PASSIVE_AUDIT_CHECKS))

It seems that in scenario 1 - there are "active phases" of the audit started (though I would not expect that to happen) and in scenario 2 there are not (as expected). However even IF in scenario 1 the scans are aborted before the active scan is started - by cancelling the audit-items iteself manually in the burp-ui - the scanner finds additional finding-types than the result of scenario 2.

can someone tell me if this is expected or if there might be something wrong with my setup of scenario2.

thx~

[Hannah-PortSwigger]

If you check the scan configuration of each task, are they different?

You can do this by clicking on the "Cog" button on a task, going to "Scan configuration", selecting your current auditing configuration and clicking "Edit".

[petrabrunner]

Hi - oh thx for the hint~ I knew about these settings, but have not yet taken a look there.

seems that the configs are NOT quite the same. (then that might be the reason)
what I observed:

• in scenario 1 - the preselected scan types include all possible types (which I would not expect when selecting "passive scan all traffic through proxy" - but alright ;))
• in scenario 2 - the selected scan types are passive and Javascript analysis.

-> so of course there would be major differences.

---

btw. I would have expected scenario1 to be pre-configured exactly the same as the "passive audit check" (see screenshot) that is started when opening a new "temporary" project in burp - (which - as described above - it is not - as the "passive audit check" really only starts "passive" scan types )

[Hannah-PortSwigger]

It looks like scenario one is caused by a bug introduced in v2022.6. A passive audit task should just be using passive scan checks, not all scan check types.

We'll raise a bug report to get this sorted out.

[petrabrunner]

marked as "answered" - as this ui-visualization (described by Hannah above) helped me understand why there ARE differences. (because the started scans are simply not exactly the same)