Scanning single-page apps - Port Swigger
Summary: PortSwigger's Burp Scanner documentation states that the scanner can handle most modern web applications, including single-page applications, but SPAs may need a custom scan configuration to be scanned accurately. It notes that SPAs often use URL fragments for client-side routing, and that the crawler by default treats a fragment as client-side routing when it contains any of the characters / \ ? = & .
Why it matters: The documentation recommends the Most complete crawl strategy for SPAs while noting it significantly increases crawl time, and explicitly advises against the Fastest strategy because it does not support links that require the scanner to click - so coverage of a JavaScript-heavy application depends on a setting that trades scan duration for reach.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026