Getting started with CI-driven scans - Port Swigger
Summary: PortSwigger's guide describes integrating Burp Scanner into any container-supporting CI/CD platform by running a Docker command in the pipeline script, configured with the DAST server URL, an API key from a CI-driven scan initiator group, and the target URL. Scan results arrive as a JUnit XML file named burp_junit_report.xml in the container's working directory, including remediation advice and the request and response evidence for each issue found.
Key Takeaway: Running the scanner as a pipeline stage means every build can produce a burp_junit_report.xml with request and response evidence attached to each finding, so the question is whether your pipeline gates on that file or lets it sit unread in the working directory.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026