Dynamic analysis of Java Script
Summary: PortSwigger's new Burp Scanner adds dynamic analysis of JavaScript, using an embedded headless browser to load HTTP responses, inject payloads into DOM locations an attacker could control, execute the JavaScript, and create mouse events to maximize code coverage while monitoring dangerous sinks for payloads that reach them. The Scanner still runs its static analysis, which parses code into an abstract syntax tree to trace tainted sources to dangerous sinks, and now correlates both techniques, reporting issues as certain when both agree and downgrading confidence when only static analysis flags a potential issue.
Bottom line: PortSwigger says it tested the new analysis against numerous bug bounty sites and found a large number of exploitable vulnerabilities that no existing tool could detect, which means DOM-based flaws your current scanner reports as clean may still be reachable.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026