PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Automatic session handling

portswigger.net | blog | #burp-suite | #crawler | #session-handling | #mobp | #csrf | #cookies
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Burp's new crawler handles sessions automatically: parallel agents keep their own cookie jars, and requests are constructed dynamically from responses so CSRF tokens need no configuration.
Published
Collected

Related coverage

blog · portswigger.net
Crawling with multiple logins
Burp's new crawler supports multiple logins for different roles, automatic self-registration, and bogus credentials for functions like account recovery, while avoiding concurrent logins per account.
blog · portswigger.net
Web application cartography: mapping out Burp Suite’s crawler
A look at Burp Scanner's crawler evolution since 2008: the Burp 2 rewrite maps applications automatically and maintains session context per request, freeing testers from manual session handling.
blog · portswigger.net
Automatically maintaining session during scans
Burp's new scanner automatically maintains sessions during audits by leveraging the crawl graph, finding the shortest path to each request and re-walking it as needed, with zero configuration.
blog · portswigger.net
Crawling volatile content
Burp's new crawler handles volatile content by identifying locations from their contents rather than URLs and modeling highly variable links as non-deterministic edges in its graph.
blog · portswigger.net
Detecting changes in application state
Burp's new crawler detects state changes triggered by its own actions, identifying the state-changing path a link depends on so it can reliably revisit locations like a populated shopping cart.
blog · portswigger.net
Burp's new crawler
PortSwigger is replacing Burp's Spider with a crawler that navigates like a user, maps applications as a directed graph of content-identified locations, and copes with ephemeral URL data.
Back