Recorded logins in Burp Scanner
Summary: PortSwigger added recordable login sequences to Burp Scanner, letting users capture a real login with a Chrome extension, export it as JSON, and paste it into Burp Suite so the Scanner replays it to authenticate. The feature handles external SSO providers, multi-stage forms, and arbitrary prompts that the older HTML-based form detection could not, though it does not work with two-factor codes, CAPTCHAs, per-login password digits, or popup windows.
What you should know: Most sites hide their interesting functionality behind authentication, so a scanner that cannot log in tests only the surface - and the recorded approach still breaks on 2FA, CAPTCHAs, and popups, which is where a security leader's real coverage gaps will sit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026