Performing a DAST security assessment on Microsoft Outlook and Teams add-ins requires configuring the host application to route traffic through an intercepting proxy like Burp Suite. Since these add-ins operate within sandboxed environments, you must configure the system-wide or application-level network settings to ensure all HTTP requests are captured. This approach allows you to inspect API calls, identify vulnerabilities in client-side code, and verify authentication flows without modifying the add-in source code directly.
Understanding the Add-in Architecture
Microsoft Outlook and Teams add-ins are typically web-based applications embedded within the desktop or web clients. They rely on the Office JavaScript API (Office.js) and often use HTML/CSS/JavaScript for their user interface. Because they run in a browser-like context, standard web security testing techniques apply, but the entry point is the host application rather than a standalone browser window.
The key challenge is that the add-in does not control the underlying network stack directly. Instead, it inherits the network configuration of the host process. For Outlook, this means the traffic goes through the Outlook.exe process. For Teams, it goes through the Teams.exe process. Both processes may use different networking libraries or WebView2 instances, which complicates direct proxy injection via command-line flags as seen in traditional browsers.
Configuring Burp Suite for Interception
To capture traffic from these add-ins, you need to set up Burp Suite Community or Professional Edition correctly. First, install the CA certificate into the Windows trust store so that HTTPS traffic can be decrypted. Without this step, you will only see encrypted blobs or connection errors.
Next, configure the proxy listener. By default, Burp listens on 127.0.0.1:8080. Ensure that the "Intercept" mode is set appropriately based on your testing phase. During active scanning, you might want to pass through most traffic and only intercept specific requests for deeper analysis.
For Outlook add-ins, the most reliable method is to configure the system proxy settings at the OS level. Go to Windows Settings > Network & Internet > Proxy. Enable "Use a proxy server" and enter 127.0.0.1 and port 8080. This forces all outbound HTTP/S traffic from Outlook to route through Burp. However, note that this affects all applications on the machine, which may interfere with other workflows during testing.
For Teams add-ins, the situation is slightly more complex because Teams uses its own networking stack. In many cases, setting the system proxy works, but if it does not, you may need to use environment variables. Set the
HTTP_PROXY and
HTTPS_PROXY environment variables to
http://127.0.0.1:8080. Restart the Teams application after setting these variables to ensure they are picked up by the process.
Testing Strategy and Scope
When assessing multiple add-ins, prioritize the scope. Identify which add-ins are critical to your business logic. Start with the most exposed ones, such as those that handle sensitive data or integrate with external APIs.
Use the Burp Site Map to visualize the attack surface. Look for endpoints that interact with backend services. Common vulnerabilities in add-ins include Cross-Site Scripting (XSS) in custom UI elements, insecure storage of tokens in local storage, and improper validation of input passed from the host application.
Pay special attention to the Office.js API calls. These calls often contain metadata about the user context, such as the user ID or tenant information. Ensure that this data is not leaked to third-party domains. You can filter requests in Burp by domain to isolate traffic belonging to your add-in versus Microsoft’s infrastructure.
Another critical area is authentication. Verify that the add-in uses OAuth 2.0 correctly and does not expose access tokens in URLs or logs. Check if the token refresh mechanism is secure and if short-lived tokens are used appropriately. If the add-in stores credentials locally, ensure they are encrypted using platform-specific secure storage mechanisms like Windows Credential Manager or macOS Keychain.
Handling False Positives and Noise
DAST tools generate significant noise when testing add-ins. Microsoft’s own services, such as Graph API endpoints, will trigger many alerts. Configure Burp to ignore known safe patterns or exclude Microsoft domains from automated scanning. Focus on requests that originate from your custom domain or backend services.
You can also use Burp’s match and replace feature to modify requests dynamically. This is useful for testing edge cases without changing the add-in code. For example, you can strip out certain headers or inject malformed JSON to test error handling.
Remember that some add-ins may cache responses aggressively. Clear the browser cache within the add-in’s WebView before each test session to ensure you are seeing fresh traffic. In Outlook, this might involve restarting the application or clearing the temporary internet files associated with the Office cache.
Best Practices for Continuous Security
Integrate DAST into your CI/CD pipeline where possible. Use headless browsers or scripted tests to automate the launch of Outlook or Teams with the add-in loaded. This ensures that security testing is consistent across releases.
Regularly update your Burp Suite certificates and rules. As Microsoft updates its clients, the way they handle proxies may change. Stay informed about any new security features or restrictions in Outlook and Teams that might impact your testing methodology.
Consider complementing DAST with SAST (Static Application Security Testing) to catch code-level issues early. Tools like SonarQube or ESLint plugins can identify potential XSS or injection flaws before deployment. Combining both approaches provides a comprehensive security posture for your add-ins.
For more information on managing Outlook configurations, see
How to Set Outlook Day Event Reminders and
How to Access an Attached File in an Email Instead of a Message.
Frequently Asked Questions
Can I use ZAP instead of Burp Suite for this task?
Yes, OWASP ZAP is a free alternative that supports similar proxy interception capabilities. You would configure ZAP similarly by setting up the system proxy or environment variables to route traffic through ZAP’s default port, usually 8080. Ensure you import ZAP’s root CA certificate into the Windows trust store to decrypt HTTPS traffic.
Why are some requests not appearing in Burp Suite?
This often happens if the add-in uses a different networking library that ignores system proxy settings. Try setting the
HTTP_PROXY and
HTTPS_PROXY environment variables explicitly. Additionally, check if the add-in is running in a sandboxed mode that restricts network access; in such cases, you may need to adjust the add-in’s manifest permissions.
Does this method work for web-based Outlook (OWA)?
No, this method is designed for the desktop client. For web-based Outlook, you should use browser developer tools or a browser extension like FoxyProxy to intercept traffic. The web version runs in the actual browser, so standard browser proxy configurations apply directly.
How do I avoid disrupting my daily workflow while testing?
Use a separate virtual machine or a dedicated testing profile in Outlook and Teams. This isolates the proxy configuration from your primary work environment. Alternatively, use Burp’s “Pass Through” mode for non-test domains to minimize interference with other applications.
Are there risks involved in installing the Burp CA certificate?
Installing a CA certificate grants the ability to decrypt HTTPS traffic for any application on the machine. Only install the certificate from trusted sources like Burp Suite. Avoid installing untrusted certificates, as they can compromise your security posture by allowing man-in-the-middle attacks on other services.