Authenticated Scanning Software from Port Swigger
Summary: PortSwigger's Burp Scanner can authenticate itself into privileged areas of web applications, using a Navigation Recorder Chromium extension to record complex login sequences such as SSO and multi-step forms, which Burp Suite then stores as JSON for reuse. Simple logins work by supplying credentials for Burp Scanner to identify HTML login forms, while JavaScript-heavy login systems are handled through the scanner's embedded Chromium browser; the scanner cannot circumvent countermeasures such as CAPTCHA.
Bottom line: The attack surface behind a login is where user dashboards and privileged data sit, and PortSwigger says its scanner is used by over 70,000 users across more than 16,000 organizations - so the same recorded-login automation that scales authenticated scanning across a portfolio is available to anyone testing your applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026