Running a full crawl and audit - Port Swigger
Summary: PortSwigger's Burp Scanner crawls and audits web applications from one or more start URLs using a built-in Chromium browser that interacts with the application as a user would. A Broken Access Control false positive reduction feature uses AI to analyze each access control issue Burp Scanner identifies, but it only works in scans that perform both authenticated and unauthenticated crawls, and it requires AI credits.
Key Takeaway: Access control flaws are described here as complex and hard to test automatically, often needing high-level manual validation - so the accuracy of what your scanner reports on them depends on whether you configured both authenticated and unauthenticated crawls and had AI credits available.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026