Lab: Scanning non-standard data structures
Summary: PortSwigger's lab presents a stored cross-site scripting vulnerability hidden in a non-standard data structure that is difficult to find manually, and instructs users to locate it with Burp Scanner's Scan selected insertion point feature. Burp Scanner reports the issue about one minute after the scan starts, detecting it by triggering an interaction with the Burp Collaborator server, which is polled for new interactions every minute by default.
Bottom line: The detection depends on an out-of-band interaction with a Collaborator server and a polling interval that delays the report by roughly a minute, so a vulnerability buried in a non-standard data structure can sit unnoticed until someone points a scanner at that specific insertion point.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026