Automatic session handling
Summary: PortSwigger says Burp's current Spider tool handles simple cookie-based sessions but fails with many CSRF token usages and multi-step processes that must run in a specific order, and working around this with recorded macros and session handling rules is often tedious and error prone. The new crawler handles sessions automatically by navigating like a browser user, with multiple crawler agents that each keep their own cookie jar, cleared when an agent returns to the start location, and requests built dynamically from the preceding response so CSRF tokens in URLs or form fields are handled with zero configuration.
What's compelling: The gap being closed is concrete: a scanner that stalls on CSRF tokens and ordered multi-step flows leaves those paths untested, and the manual macro workaround is described as error prone - so coverage depends on how much configuration someone got right.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026