PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Multi-phase scanning

portswigger.net | blog | #burp-suite | #ui | #audit | #scanner | #mobp | #multi-phase-scanning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Burp's new scanner organizes audit work into passive, active, and JavaScript analysis phases, completing each phase across all items before the next, with a new UI for tracking per-item progress.
Published
Collected

Related coverage

blog · portswigger.net
Launching scans
Burp's new scan launcher unifies crawling and auditing into one scan concept, letting users combine configuration presets, login credentials, and resource pools for each scan.
blog · portswigger.net
The new configuration library
With parallel scans each needing their own settings, Burp introduces a configuration library that stores built-in and user-defined configurations, importable and exportable as JSON for sharing.
blog · portswigger.net
Improved management of system resources
Burp's new task execution engine centrally manages CPU and network resources across tasks, with configurable resource pools, dynamic thread sizing, and steadier behavior under low memory.
blog · portswigger.net
Multiple parallel scans
Burp will replace its singleton Spider and Scanner tools with multiple parallel scans, each having its own configuration, scope, and queue, controllable and prioritizable independently.
blog · portswigger.net
Dynamic analysis of JavaScript
Burp's new scanner adds dynamic JavaScript analysis via an embedded headless browser, injecting payloads into the DOM and monitoring sinks to reliably uncover DOM-based vulnerabilities.
blog · portswigger.net
Handling application errors during scans
Burp's new scanner tracks scan errors granularly, retries failed operations in follow-up passes after each phase, and can optionally pause the whole scan when an application appears to be down.
Back