Forest Global Training Partners

Cyber Risks · PortSwigger Research

Automatically maintaining session during scans

Summary: PortSwigger rebuilt Burp Scanner's core logic so that, when an audit follows an automated crawl, the scanner uses the crawl's graph of navigational pathways to maintain application sessions automatically with zero configuration. Before auditing a request, it identifies the shortest path from the crawl's starting location, rewalks it to obtain fresh session tokens, and tests simplifications of the path - reissuing the final request alone where cookies or reusable CSRF tokens allow, reissuing the preceding request for single-use CSRF tokens, or walking the full path from the start in high-security applications with tightly controlled navigation.

Why it matters: The scanner periodically checks that its session is still valid, sets checkpoints on completed audit checks, and rolls back to the latest checkpoint when a session is lost - a case the source illustrates with a web application firewall terminating the session after flagging scan payloads as malicious. That rollback logic is what stands between a WAF cutting a session mid-audit and the scan losing its place.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related