Configuring platform authentication - Port Swigger
Summary: PortSwigger's documentation describes how Burp Scanner can be given HTTP Basic and NTLM credentials at the platform level, so it authenticates automatically to destination web servers for all traffic to that host. Credentials are added when a site or folder is created or edited, appear in the Platform authentication tab, and Burp uses the first matching entry in the list, which allows per-host configuration or disabling authentication for a specific host.
What's compelling: Storing scanner credentials per host means the account Burp authenticates with defines exactly what the scanner can reach, and the first-match list order decides which credentials apply when hosts overlap.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026