Detecting changes in application state
Summary: PortSwigger's new Burp crawler detects changes in application state caused by actions it performs during a crawl, so it can tell when the same link leads to different content depending on prior steps. In the example given, navigating path BC moves the application from state 1 to state 2, so path AD reaches an empty shopping cart while ABCD reaches the populated cart.
Key Takeaway: A crawler that writes off a link as non-deterministic misses the state-changing path it depends on, and with it every function reachable only from the populated cart - coverage gaps that leave those paths unscanned.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026