Best practices for scanning - Port Swigger
Summary: PortSwigger's guidance on Burp Suite DAST scan configurations says preset configurations work for most cases, but SPAs and complex frameworks may need custom ones, and it recommends running regular Lightweight scans alongside a scheduled deeper scan monthly. The default crawl duration is 2 hours 30 minutes, adjustable via Crawling > Crawl limits > Maximum crawl time, and the article notes that MFA is designed to prevent automated attacks, so scanners should use a dedicated account without MFA or with a fixed code.
Why it matters: A default crawl budget of 2 hours 30 minutes per scan, plus MFA blocking automated logins, means coverage depends on tuning crawl limits and carving out a dedicated scan account - decisions that determine whether the scanner actually reaches your application's attack surface.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026