Login credentials - Port Swigger

Summary: PortSwigger's documentation states that Burp Suite Professional and Burp Suite DAST let you supply login credentials for applications with a single-step login mechanism, so Burp Scanner can audit content only authenticated users can see. The scanner starts with an unauthenticated crawl to find login and self-registration functions, then attempts an authenticated crawl, logging in with each set of credentials in turn; if both credentials and a recorded login sequence are provided, the scanner ignores the credentials.
Why it matters: Only one authentication method applies per scan, and complex login mechanisms require a recorded login sequence because the scanner may otherwise fail to log in - leaving authenticated areas of the application unaudited.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026