Browser-powered scanning - Port Swigger
Summary: PortSwigger's Burp Scanner uses an embedded Chromium browser to navigate during both the crawl and audit phases of a scan, letting it render client-side technology that a regular crawler engine cannot. The browser executes scripts to build dynamically generated UIs and trigger JavaScript event handlers, and it can record and upload full login sequences including single sign-on.
Why it matters: A regular crawler engine misses vulnerabilities on pages whose UI only exists after JavaScript runs, so coverage depends on whether your scanner actually renders the page. Complex login mechanisms, single sign-on among them, are also where scanning either reaches the application or stops at the door.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026