Setting the site scope - Port Swigger
Summary: PortSwigger's documentation explains that Burp Suite DAST defines scan scope in two ways: Basic mode derives scope automatically from start URLs and lets you add or exclude URL prefixes, while Advanced mode requires regex rules covering every URL you want scanned, including the start URL domains. In Basic mode, subdomains are excluded unless added separately, a trailing slash restricts the scan to a directory, and overlapping scopes resolve to the broadest one.
Key Takeaway: A missing trailing slash on a directory URL silently widens the scan to the entire domain, and in Advanced mode any start URL not covered by an in-scope rule blocks you from saving the site - so scope mistakes change what gets tested without an obvious warning.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026