Forest Global Training Partners

Cyber Risks · PortSwigger Research

Recording login sequences - Port Swigger

Summary: PortSwigger's Burp Scanner now supports recorded login sequences that let it audit content behind complex authentication such as Single Sign-On, with the Login Recorder Chrome extension required to record logins in Burp Suite DAST and optional in Burp Suite Professional, where Burp's browser ships with it pre-installed. The company also offers AI-generated login sequences in both products, recommends recording a sequence even for basic username and password sites, and notes that the two authentication methods cannot be used together on a single application.

What's compelling: Authenticated areas are where the sensitive data sits, and PortSwigger warns that recording a login without incognito mode can produce a sequence that appears to work but stops working after your session ends - leaving scans that look complete while never reaching the pages behind the login.

Read the original at PortSwigger Research ↗

Topics
Identity & Access Management
Related