Passive scan check worked example - Port Swigger
Summary: PortSwigger published a worked example showing how to write a passive custom scan check for Burp Scanner in Java, which reports an issue when a response lacks a Content-Security-Policy header. The check runs once per request, exits cleanly when no response exists, uses a case-insensitive header lookup, and files findings at LOW severity with FIRM confidence.
Bottom line: The example's own list of what passive checks catch - missing security headers, leaked server information in error messages, insecure cookies and form configurations - is a reminder that these gaps sit in responses your scanner already sees, and only surface if someone writes the check for them.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026