Crawling with multiple logins
Summary: PortSwigger's new Burp Scanner crawler adds support for configuring multiple logins for different user roles and for self-registering user accounts, replacing the older Spider's single username-and-password login and macro-based session handling that worked with only one account at a time. It runs an unauthenticated phase to find login and self-registration functions, then an authenticated phase that submits each set of credentials and crawls the content behind each login, detecting applications that prohibit concurrent login by the same user and limiting those accounts to a single concurrent login.
Bottom line: The crawler builds a graph of navigational pathways so it can revisit content found in a given user context by replaying the login with the required credentials - meaning coverage of role-specific functionality now depends on how completely those roles and credentials are configured.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026