PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Browser powered scanning in Burp Suite

portswigger.net | blog | #burp-suite | #javascript | #burp-scanner | #crawler | #architecture | #chromium | #browser-based-scanning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A deep dive into why Burp Suite's scanner is powered by an integrated Chromium browser: modern AJAX-heavy apps build the DOM client-side, so reliable crawling now requires real browser rendering.
Published
Collected

Related coverage

blog · portswigger.net
Web application cartography: mapping out Burp Suite’s crawler
A look at Burp Scanner's crawler evolution since 2008: the Burp 2 rewrite maps applications automatically and maintains session context per request, freeing testers from manual session handling.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Keep it simple, Scanner
A Burp Scanner engineer reflects on simplifying the crawler: the new crawl paths view exposes the internal location graph, so legacy complexity like merge optimization is being pruned away.
blog · portswigger.net
Burp Scanner can now crawl static sites between 6x - 9x faster
Burp Suite Professional 2022.2.3 makes Burp Scanner's crawler 6x-9x faster on static or stateless sites. Select the Fastest crawl strategy to benefit from this automated recon speed-up.
blog · portswigger.net
Recorded logins in Burp Scanner
Burp Scanner's Recorded logins feature lets you record complex login sequences that the scanner replays through Chromium, reaching JavaScript-rendered and role-protected areas during scans.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
Back