PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp's new crawler

portswigger.net | blog | #burp-suite | #crawler | #web-crawling | #spider | #mobp | #csrf | #directed-graph
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PortSwigger is replacing Burp's Spider with a crawler that navigates like a user, maps applications as a directed graph of content-identified locations, and copes with ephemeral URL data.
Published
Collected

Related coverage

blog · portswigger.net
Crawling volatile content
Burp's new crawler handles volatile content by identifying locations from their contents rather than URLs and modeling highly variable links as non-deterministic edges in its graph.
blog · portswigger.net
Detecting changes in application state
Burp's new crawler detects state changes triggered by its own actions, identifying the state-changing path a link depends on so it can reliably revisit locations like a populated shopping cart.
blog · portswigger.net
Web application cartography: mapping out Burp Suite’s crawler
A look at Burp Scanner's crawler evolution since 2008: the Burp 2 rewrite maps applications automatically and maintains session context per request, freeing testers from manual session handling.
blog · portswigger.net
Multiple parallel scans
Burp will replace its singleton Spider and Scanner tools with multiple parallel scans, each having its own configuration, scope, and queue, controllable and prioritizable independently.
blog · portswigger.net
Crawling with multiple logins
Burp's new crawler supports multiple logins for different roles, automatic self-registration, and bogus credentials for functions like account recovery, while avoiding concurrent logins per account.
blog · portswigger.net
Automatic session handling
Burp's new crawler handles sessions automatically: parallel agents keep their own cookie jars, and requests are constructed dynamically from responses so CSRF tokens need no configuration.
Back