Setting the scan scope in Burp Suite Professional - Port Swigger
Summary: PortSwigger's documentation for Burp Suite Professional describes how the Scan details section of the scan launcher sets what Burp Scanner will crawl, starting from one or more configured start URLs and following links from them. By default the crawl scope is limited to the start URL's path ending at its final directory, determined by the last slash, so a URL ending in myfolder without a trailing slash keeps the parent path in scope while adding the slash restricts the scan to that directory.
What you should know: A single missing trailing slash can widen a scan from one folder to an entire application path, and the documentation notes that when content is identical over HTTP and HTTPS, Burp scans that location only once even if both protocols are selected.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026