Frequently occurring insertion points
Summary: PortSwigger describes a change to Burp Scanner's auditing approach: the current Scanner audits each request in isolation, running all configured checks across every insertion point, which becomes inefficient when auditing a whole application because some insertion points recur across many or all requests without representing interesting attack surface. The new Scanner identifies frequently occurring insertion points as uninteresting when prior scans produced either no issues or the same set of issues each time, and audits them more lightly by first sending a small number of requests to detect server-side processing before deciding whether to run a full audit.
What's compelling: The trade-off is explicit: flagged insertion points are still audited, but only lightly unless anomalous behavior confirms server-side processing, so the redundant work avoided is also coverage that now depends on that initial probe.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026