Configuring authentication for web apps - Port Swigger
Summary: PortSwigger documentation explains that adding authentication credentials for web app sites lets Burp Scanner discover and audit content only accessible to authenticated users. It states that only one login mechanism can be used per site, and that NTLM and HTTP Basic credentials let Burp Scanner authenticate to destination web servers at the platform level.
Bottom line: Scanner coverage stops at the login wall unless credentials are configured, so the authenticated portions of an application - where the sensitive data and logic live - are exactly what goes unaudited by default.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026