Adding usernames and passwords for a web app - Port Swigger
Summary: PortSwigger's documentation describes how Burp Scanner can be given a username and password so it logs in to a web app and audits content normally visible only to authenticated users. It recommends a recorded login sequence even for basic username and password authentication, because recorded logins let the pre-scan check confirm authentication is working, provide troubleshooting, and support a status checker that makes scans faster and deeper.
What you should know: Authenticated scanning reaches the content behind the login, which is where most sensitive data sits - and the pre-scan check that confirms authentication is working only comes with a recorded login sequence, not a bare set of credentials.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026