Sample Burp Suite extension: custom scanner checks
Summary: PortSwigger published a sample Burp Suite extension that adds custom passive and active scan checks to Burp Scanner, invoked at the relevant stage for each base request and insertion point sent for scanning. The download includes Java source code, a compiled JAR, and an updated ASP.NET page with two fictitious vulnerabilities for testing, and running it requires the earlier custom scan insertion points example so the active scan payload is inserted correctly into the serialized request.
Bottom line: The extension can issue its own requests during active scanning and report its own custom scan issues, which means scan traffic and findings can extend beyond what the built-in checks cover - a capability worth tracking when you account for what touches your applications during a scan.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026