Scanning web applications - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite Professional configures and runs web application scans, automatically cataloging and analyzing an application's structure and traffic, including any REST, SOAP, and GraphQL APIs it discovers. All requests, responses, and resources found during a scan are added to the site map, and the section covers launching one-off scans, with API-only scans based on an OpenAPI definition or SOAP WSDL covered separately.
Bottom line: The scanner's coverage depends on what it can discover and reach: it catalogs the APIs it finds and maps only the traffic it sees, so anything outside that view stays unscanned.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026