[MoBP] Scan optimisation

Summary: PortSwigger published a post describing how Burp Scanner exposes scan progress, showing per-request insertion point counts and generated attack request numbers in the active scan queue. The post details controls for cancelling or re-prioritising queued items, skipping server-side injection tests for specific parameters, and turning individual check categories such as LDAP injection on or off.
What's compelling: The post states that the number of attack requests is not a linear function of insertion points, because observed application behaviour feeds back into subsequent requests - so scan volume and scan time are driven by how the target responds, not by how many payload locations you configure.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026