Monday, April 10, 2023

Add Manually Crawled Links to Burp Enterprise Scans

I've used Burp Suite Pro for many years, and I have a particular way I like to use scanning as part of my workflow. I generally do my manual testing first and then click on individual HTTP requests and send them to a predefined scanning task when I'm done. This ensures I see and get hands on with each page and API request, and I can be intentional about both manually testing them and making sure they are scanned properly afterward. There's a bit more to it, but I'm going to skip past those details as they aren't the point of this article.

More recently, I've been helping an organization set up Burp Enterprise to scan their applications. Both Burp Enterprise and Burp Pro have the same scanning engines, but Burp Enterprise does not let you get as granular with what you want scan. I can't, for example, crawl the whole application manually and then feed those URLs to a Burp Enterprise scan. 

In this case, that's exactly what I wanted to do however. There were several single-page applications, and Burp Enterprise could use a helping hand. So, I first manually crawled the application using Burp Suite Pro, using as many of the features as I could successfully. Then, I highlighted all the requests in my proxy history, right clicked, and chose "Copy URLs".

Next, I needed to give these URLs to Burp Enterprise somehow. My first attempt was to put them in the "Include URLs" box found when creating a site (shown below).

 

However, when saving the site, Burp Enterprise complained that URL parameters were not permitted. That was unfortunate, because those URL parameters contained database IDs of objects I wanted to include (and have it further crawl) that in previous scans it was unable to find itself.

I eventually came up with a neat workaround. Instead of putting the URLs directly into the site's configuration, I chose to create a helper page that Burp Enterprise could crawl. Since I didn't have access to the developers' applications themselves, I created an NGINX pod in Kubernetes containing anchor tags with all the manually discovered URLs (including their URL parameters).

First, I created a new text file and pasted in all the copied URLs to a file called urls.txt. Then, I sorted them, eliminated any duplicates, and used a REGEX to convert them into anchor tags. Next, I created a ConfigMap with those values. To serve up that ConfigMap as a web page, I mounted the ConfigMap in an NGINX pod as a volume and created a Service to give it a predictable DNS name. Now, I can add a single URL pointing at my NGINX pod into the "Include URLs" section of Burp Enterprise when creating a site.


$ sed 's/\(.*\)/<a href="\1">\1<\/><br\/>/' urls.txt > urls2.txt

$ microk8s kubectl -n burp create configmap urlhelper --from-file=juiceshop.html=urls2.txt
configmap/urlhelper created

$ microk8s kubectl -n burp get configmap urlhelper -o yaml
apiVersion: v1
data:
  juiceshop.html: |
    <a href="https://juice-shop.herokuapp.com/">https://juice-shop.herokuapp.com/</><br/>
    <a href="https://juice-shop.herokuapp.com/runtime.js">https://juice-shop.herokuapp.com/runtime.js</><br/>
    <a href="https://juice-shop.herokuapp.com/main.js">https://juice-shop.herokuapp.com/main.js</><br/>
    <a href="https://juice-shop.herokuapp.com/vendor.js">https://juice-shop.herokuapp.com/vendor.js</><br/>
    <a href="https://juice-shop.herokuapp.com/polyfills.js">https://juice-shop.herokuapp.com/polyfills.js</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/assets/i18n/en.json">https://juice-shop.herokuapp.com/assets/i18n/en.json</><br/>
    <a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
    <a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/languages">https://juice-shop.herokuapp.com/rest/languages</><br/>
    <a href="https://juice-shop.herokuapp.com/api/Quantitys/">https://juice-shop.herokuapp.com/api/Quantitys/</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/products/search?q=">https://juice-shop.herokuapp.com/rest/products/search?q=</><br/>
    <a href="https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2">https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
    <a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
    <a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
    <a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/user/login">https://juice-shop.herokuapp.com/rest/user/login</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
    <a href="https://juice-shop.herokuapp.com/font-mfizz.woff">https://juice-shop.herokuapp.com/font-mfizz.woff</><br/>
    <a href="https://juice-shop.herokuapp.com/api/Feedbacks/">https://juice-shop.herokuapp.com/api/Feedbacks/</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/memories/">https://juice-shop.herokuapp.com/rest/memories/</><br/>
    <a href="https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-">https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
    <a href="https://juice-shop.herokuapp.com/api/Challenges/?sort=name">https://juice-shop.herokuapp.com/api/Challenges/?sort=name</><br/>
    <a href="https://juice-shop.herokuapp.com/snippets">https://juice-shop.herokuapp.com/snippets</><br/>
    <a href="https://juice-shop.herokuapp.com/tutorial.js">https://juice-shop.herokuapp.com/tutorial.js</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/continue-code">https://juice-shop.herokuapp.com/rest/continue-code</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/continue-code-fixIt">https://juice-shop.herokuapp.com/rest/continue-code-fixIt</><br/>
    <a href="https://juice-shop.herokuapp.com/rest/continue-code-findIt">https://juice-shop.herokuapp.com/rest/continue-code-findIt</><br/>
kind: ConfigMap
metadata:
  creationTimestamp: "2023-04-10T19:23:28Z"
  name: urlhelper
  namespace: burp
  resourceVersion: "4625706"
  uid: 2e115572-aad4-4516-bd7a-0a3f43f05eee

$ cat urlhelper-dep.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: urlhelper
  name: urlhelper
  namespace: burp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: urlhelper
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: urlhelper
    spec:
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
        resources: {}
        volumeMounts:
        - name: pages
          mountPath: /usr/share/nginx/html/
      volumes:
      - name: pages
        configMap:
          name: urlhelper

 $ microk8s kubectl -n burp apply -f urlhelper-dep.yaml

$ microk8s kubectl -n burp expose deployment urlhelper --port 80 --target-port 80

$ microk8s kubectl -n burp exec -it urlhelper-5f45f6b6cc-597ks -- bash
root@urlhelper-5f45f6b6cc-597ks:/# curl localhost/juiceshop.html
<a href="https://juice-shop.herokuapp.com/">https://juice-shop.herokuapp.com/</><br/>
<a href="https://juice-shop.herokuapp.com/runtime.js">https://juice-shop.herokuapp.com/runtime.js</><br/>
<a href="https://juice-shop.herokuapp.com/main.js">https://juice-shop.herokuapp.com/main.js</><br/>
<a href="https://juice-shop.herokuapp.com/vendor.js">https://juice-shop.herokuapp.com/vendor.js</><br/>
<a href="https://juice-shop.herokuapp.com/polyfills.js">https://juice-shop.herokuapp.com/polyfills.js</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/assets/i18n/en.json">https://juice-shop.herokuapp.com/assets/i18n/en.json</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
<a href="https://juice-shop.herokuapp.com/rest/languages">https://juice-shop.herokuapp.com/rest/languages</><br/>
<a href="https://juice-shop.herokuapp.com/api/Quantitys/">https://juice-shop.herokuapp.com/api/Quantitys/</><br/>
<a href="https://juice-shop.herokuapp.com/rest/products/search?q=">https://juice-shop.herokuapp.com/rest/products/search?q=</><br/>
<a href="https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2">https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/login">https://juice-shop.herokuapp.com/rest/user/login</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
<a href="https://juice-shop.herokuapp.com/font-mfizz.woff">https://juice-shop.herokuapp.com/font-mfizz.woff</><br/>
<a href="https://juice-shop.herokuapp.com/api/Feedbacks/">https://juice-shop.herokuapp.com/api/Feedbacks/</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/memories/">https://juice-shop.herokuapp.com/rest/memories/</><br/>
<a href="https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-">https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?sort=name">https://juice-shop.herokuapp.com/api/Challenges/?sort=name</><br/>
<a href="https://juice-shop.herokuapp.com/snippets">https://juice-shop.herokuapp.com/snippets</><br/>
<a href="https://juice-shop.herokuapp.com/tutorial.js">https://juice-shop.herokuapp.com/tutorial.js</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code">https://juice-shop.herokuapp.com/rest/continue-code</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code-fixIt">https://juice-shop.herokuapp.com/rest/continue-code-fixIt</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code-findIt">https://juice-shop.herokuapp.com/rest/continue-code-findIt</><br/>

root@urlhelper-5f45f6b6cc-597ks:/# curl urlhelper/juiceshop.html
<a href="https://juice-shop.herokuapp.com/">https://juice-shop.herokuapp.com/</><br/>
<a href="https://juice-shop.herokuapp.com/runtime.js">https://juice-shop.herokuapp.com/runtime.js</><br/>
<a href="https://juice-shop.herokuapp.com/main.js">https://juice-shop.herokuapp.com/main.js</><br/>
<a href="https://juice-shop.herokuapp.com/vendor.js">https://juice-shop.herokuapp.com/vendor.js</><br/>
<a href="https://juice-shop.herokuapp.com/polyfills.js">https://juice-shop.herokuapp.com/polyfills.js</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/assets/i18n/en.json">https://juice-shop.herokuapp.com/assets/i18n/en.json</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicltI</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
<a href="https://juice-shop.herokuapp.com/rest/languages">https://juice-shop.herokuapp.com/rest/languages</><br/>
<a href="https://juice-shop.herokuapp.com/api/Quantitys/">https://juice-shop.herokuapp.com/api/Quantitys/</><br/>
<a href="https://juice-shop.herokuapp.com/rest/products/search?q=">https://juice-shop.herokuapp.com/rest/products/search?q=</><br/>
<a href="https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2">https://juice-shop.herokuapp.com/MaterialIcons-Regular.woff2</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_w&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicl_m&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-version">https://juice-shop.herokuapp.com/rest/admin/application-version</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board">https://juice-shop.herokuapp.com/api/Challenges/?name=Score%20Board</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=websocket&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6">https://juice-shop.herokuapp.com/socket.io/?EIO=4&transport=polling&t=OTicm7r&sid=05A4bqW6z9wJ6T5rAHn6</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/login">https://juice-shop.herokuapp.com/rest/user/login</><br/>
<a href="https://juice-shop.herokuapp.com/rest/user/whoami">https://juice-shop.herokuapp.com/rest/user/whoami</><br/>
<a href="https://juice-shop.herokuapp.com/font-mfizz.woff">https://juice-shop.herokuapp.com/font-mfizz.woff</><br/>
<a href="https://juice-shop.herokuapp.com/api/Feedbacks/">https://juice-shop.herokuapp.com/api/Feedbacks/</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/rest/memories/">https://juice-shop.herokuapp.com/rest/memories/</><br/>
<a href="https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-">https://juice-shop.herokuapp.com/assets/public/images/uploads/%F0%9F%98%BC-</><br/>
<a href="https://juice-shop.herokuapp.com/rest/admin/application-configuration">https://juice-shop.herokuapp.com/rest/admin/application-configuration</><br/>
<a href="https://juice-shop.herokuapp.com/api/Challenges/?sort=name">https://juice-shop.herokuapp.com/api/Challenges/?sort=name</><br/>
<a href="https://juice-shop.herokuapp.com/snippets">https://juice-shop.herokuapp.com/snippets</><br/>
<a href="https://juice-shop.herokuapp.com/tutorial.js">https://juice-shop.herokuapp.com/tutorial.js</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code">https://juice-shop.herokuapp.com/rest/continue-code</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code-fixIt">https://juice-shop.herokuapp.com/rest/continue-code-fixIt</><br/>
<a href="https://juice-shop.herokuapp.com/rest/continue-code-findIt">https://juice-shop.herokuapp.com/rest/continue-code-findIt</><br/>

Then within the include URLs, add "http://urlhelper/juiceshop.html" or "http://urlhelper.burp.svc.cluster.local/juiceshop.html". Burp Enterprise will visit this page and then crawl all the links from that page.