Preparing Service Now for Burp Suite DAST - Port Swigger
Summary: PortSwigger's guidance for connecting Burp Suite DAST to ServiceNow says the integration user needs three roles - itil, personalize_dictionary and personalize_choices - and that the connection check passes even for a user with no roles, so a green check does not confirm the roles are correct. It also recommends the admin role, because without it Burp Suite DAST cannot read two sources of required fields and will show ServiceNow-mandated fields as optional, letting an action be saved that ServiceNow then rejects when the ticket is raised.
Bottom line: ServiceNow silently drops any field the integration user cannot write, so tickets get created missing data with no error shown - and if the admin role is not granted, PortSwigger's own advice is to raise a test ticket from every action before relying on it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026