Configuring Burp Suite DAST (Standard) - Port Swigger
Summary: PortSwigger's setup guide for Burp Suite DAST describes the first-run configuration flow: creating an administrator user, entering external database credentials for the DAST server and scanning machine users, and optionally uploading a TLS certificate to replace the self-signed one generated during installation. The guide notes that browsers may show an "invalid certificate" message on first access, that cipher suites for external communication can be set via the BSEE_TLS_CIPHER_SUITES environment variable, and that internal cipher suites between DAST components cannot be configured.
Bottom line: The default install ships with a self-signed certificate, and the documentation warns users may be unable to access the application without the correct certificate in place - a gap that persists until someone uploads a valid one. Cipher suite control also stops at the external boundary, leaving internal traffic between DAST components on settings you cannot change.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026