Burp / nuclei importer — auto-populate findings from web tooling

[kocaemre]

Idea

Today's importer surface = nmap (text/XML/greppable) + AutoRecon zip. Web pentesters spend most of their time in Burp + nuclei, and the JSON exports both produce contain everything needed to auto-populate findings — title, severity, host, URL, evidence, CVSS where present.

Manual data entry from Burp into recon-deck's findings panel is the #1 friction point reported (anecdotally, and from the way pentesters annotate `notes`).

Proposal

Burp issue export

Burp Pro: `Issue activity → Export issues → XML`. Format is well-documented (`...` with `name`, `severity`, `host`, `path`, `issueDetail`, `issueBackground`, `remediationDetail`).

`/api/import/burp` (POST, multipart) parses the XML and creates one finding per Burp issue, scoped to the matched (host, port) when the URL parses cleanly. Severity maps:

• Burp `Information` → `info`
• `Low` → `low`
• `Medium` → `medium`
• `High` → `high`

Issue body becomes the finding description; a `source: burp` tag distinguishes them in the findings panel.

nuclei JSONL export

`nuclei -jsonl -o results.jsonl` produces one JSON object per line. Each carries `template-id`, `info.severity`, `info.name`, `matcher-name`, `matched-at` (URL or host:port), `info.classification.cvss-score`, etc.

`/api/import/nuclei` parses JSONL, creates findings the same way. `info.classification.cve-id` populates the finding's CVE field automatically.

URL → port mapping

The most error-prone bit. Both Burp and nuclei reference targets as URLs (`https://10.0.0.1:8443/admin\`). Importer extracts host + port + scheme:

• Match against existing `hosts.ip` / `hosts.hostname`
• Match port via `ports.port` + service heuristic (`https://` → 443/tunneled, `http://` → 80)
• If no match: file the finding as engagement-level (no `port_id`), with a warning

UI

• Settings → Imports gets two new buttons (drop / paste): "Import Burp XML", "Import nuclei JSONL"
• Findings panel filter: `source = burp | nuclei | manual`
• Re-import same file: dedupe via stable (template-id / Burp issue type) + (host, port) — if the finding already exists with the same key, update instead of duplicate

Out of scope

• Live Burp / nuclei integration (HTTP listener for export-on-the-fly)
• Importing nuclei `-jsonl` from stdin or a piped command
• Burp Community-edition export — only Pro XML for now

Acceptance

• `/api/import/burp` accepts a Burp XML file, creates findings keyed to host+port, dedupes on re-import
• `/api/import/nuclei` accepts JSONL, same behavior
• Findings panel filter shows the new `source` values
• E2E fixture: a small Burp XML + nuclei JSONL drop, verify expected finding rows

Notes

Combines well with the report polish issue — auto-imported findings become the bulk of the deliverable narrative.