Scanning web apps - Port Swigger
Summary: PortSwigger's documentation describes how to add a web app site in Burp Suite DAST: users select Sites > Add a new site, choose Web app as the site type, enter a unique site name and Start URLs (no wildcards permitted), and pick a preset or custom scan configuration before saving. When a web app is scanned, Burp Scanner also scans any APIs it finds within the site scope, and the documentation notes that changing a site's scan configuration can affect issue trends over time and cause inaccurate time estimates.
What you should know: The documentation warns that altering scan configuration on an existing site can skew issue trends and time estimates, so a security leader tracking vulnerability counts over time may be reading a trend line that shifted because a setting changed, not because risk did.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026