Audit settings - Port Swigger
Summary: PortSwigger's documentation for Burp Scanner describes the audit-phase settings that control scan behavior in Burp Suite Professional and Burp Suite DAST, including audit accuracy, automatic session handling, redirect following, scan time limits, and timeout handling. It also covers scan check selection, insertion point types, payload relocation rules, and nested insertion points, noting that each check Burp performs increases the number of requests made and the overall audit time.
Bottom line: The documentation states that active issue checks send requests that might reasonably be viewed as malicious or might damage the application and its data, and that payload relocation can bypass per-parameter input validation performed by applications and firewalls - so the settings a team chooses determine how far a scan reaches into production systems.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026