Best practice for recording login sequences - Port Swigger
Summary: PortSwigger's recorded login sequence feature lets Burp Scanner supply login details for authenticated scanning of applications with complex login mechanisms, and the company recommends using it even for sites with basic username and password authentication. Recorded logins support the status check that helps the scanner stay logged in, and in Burp Suite DAST they also enable a pre-scan check that confirms authentication works before scanning begins.
What you should know: Recorded logins do not support CAPTCHA, and if Burp Scanner cannot replay a recorded login sequence during a scan it cannot perform an authenticated crawl, though the scan still runs - so a broken login sequence can leave you with scan results that never reached the authenticated parts of the application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026