Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Burp AT operates inside the Burp project a tester has open, and its activity surfaces across Logger, the Dashboard, Target's Site map, and Issues. Requests Burp AT creates can be sent to other Burp tools via Show details and Send to, so...
PortSwigger's Burp AT organizes work into tasks, where each task is an ongoing conversation that accepts follow-up prompts to dig into a result, adjust a request, or point the tool at something new. Task data is stored in the Burp project in use, several...
PortSwigger's Burp AT logs each vulnerability it finds as a Burp issue, reporting findings in the task as it works, on the scan task's Issues tab, and against the linked node in Target > Site map. Burp AT sets severity and confidence itself, includes the...
PortSwigger's Burp AI and Burp AT require outbound HTTPS traffic to ai.portswigger.net on port 443, and organizations using firewalls or content filtering must allowlist that host. The guide lists three causes of failed AI connectivity: being offline, a...
PortSwigger's documentation describes a bulk actions menu in Burp Suite DAST that lets users cancel or delete multiple scans at once, or rescan selected sites with the same configurations as before. The Scan again and Cancel actions are unavailable for...
PortSwigger's Burp Suite DAST lets users pause scans manually or through scan freeze windows that repeat weekly or run between set start and end dates, and pausing a scan creates a project file on the DAST server so it can resume from the same point. That...
PortSwigger's documentation describes the Timeline tab in Burp Scanner, which shows a scan's current stage and the time remaining, with that estimate depending on factors including the chosen scan configuration. For web app scans, Burp Scanner runs the...
PortSwigger's documentation describes how Burp Suite DAST users can download an event log in CSV format for debugging, and how support may request a scan debug pack or a verbose debug pack. The verbose debug pack contains a Burp Suite DAST project file...
PortSwigger's guidance on managing false positives notes that all automated scanners can flag issues as vulnerabilities that pose no actual risk. It recommends a workflow that starts with reviewing confidence ratings, understanding the issue type and...
PortSwigger's documentation describes settings in Burp Suite DAST that control how sites and scan data are managed, including creating new sites for API-generated scans and changing the criteria that identify issues as new. Administrators can set automatic...
PortSwigger's guidance on Burp Suite DAST scan configurations says preset configurations work for most cases, but SPAs and complex frameworks may need custom ones, and it recommends running regular Lightweight scans alongside a scheduled deeper scan...
This PortSwigger page is the "Managing your scans" section of the Burp Suite DAST user guide, covering how users create and manage scans in the product. It lists subsections on creating scans, scheduled scans, bulk actions, pausing and resuming, viewing...
PortSwigger's documentation describes how to read Burp Scanner results across tabs: the Dashboard shows scan graphs, the Issues tab lists found security issues grouped by type with instance counts, remediation advice and the request log, and the Discovered...
PortSwigger's documentation describes how Burp Suite DAST users can open an issue record to view a detailed description and a Timeline tab showing the full history of that issue. The timeline is available only on an issue record opened at the global,...
Burp Suite DAST generates statistics and charts that track how a site's security issues change over time, including new and resolved issues and a severity trend chart sorted by severity. Dashboards populate after a few scans and can be viewed per site or...
PortSwigger's Burp Suite DAST lets teams re-test individual issues to confirm a fix without waiting for a full scan, replaying the relevant requests and updating each issue's scanner status based on the outcome. When a later scan covers a location where an...
PortSwigger's documentation states that when an admin user has configured a Trello integration, Burp Suite DAST users can raise Trello cards for issues directly from the product by clicking the Raise Trello card button in the upper-right corner of the...
PortSwigger's documentation describes how Burp Suite DAST users with an admin-configured Jira integration can raise Jira tickets directly from scan results using the Raise Jira Ticket button, which adds a ticket with a link to the issue to the Jira project...
PortSwigger documented that Burp Suite DAST users whose admin has configured a GitLab integration can raise GitLab issues directly from within the tool for any issue found by a scan. The documentation notes that when other issue-tracking platforms are also...
PortSwigger's documentation describes how users of Burp Suite DAST can manage scan findings after a scan, setting statuses such as False positive or Accepted risk, adding comments, and editing severity, with each change recorded in the issue's timeline...
PortSwigger's Burp Suite DAST now records AI-enhanced scanning findings in the Details section of the Issues tab and shows the outcome on the Issues page and in the Severity section of the Advisory tab, with two possible outcomes and a filter for Burp AI...
PortSwigger's documentation states that users and groups pushed to Burp Suite DAST via SCIM are labeled as such in the web UI and are managed differently from local users created directly in the product. SCIM group membership and user removal cannot be...
PortSwigger documentation describes how Burp Suite DAST can match its local groups to Okta groups when SCIM is not in use, by creating Group Attribute Statements in Okta with a filter value whose regex sends all groups. If the Okta integration already...
PortSwigger documentation describes how Burp Suite DAST users who are not using SCIM can map local DAST groups to Entra ID groups by selecting the Customize the name of the group claim checkbox and entering the claim values. If the Entra ID application...
PortSwigger's guidance describes how Burp Suite DAST can map its local groups to ADFS groups when SCIM is not in use, either through a central claim issuance policy or through claim rules configured group by group. A central policy sends all of a user's...
PortSwigger's Burp Suite DAST uses role-based access control, letting administrators manage user permissions through roles and groups after users are added. Groups can be configured to provide vertical segregation, where some users initiate scans while...
PortSwigger documentation describes using groups in Burp Suite to restrict user access to parts of an organization's infrastructure. Groups have no site restrictions by default, but can be configured to limit access to relevant sites, such as allowing a...
PortSwigger's documentation describes how to reset the initial administrator password for Burp Suite DAST, which is set the first time the product is launched. Cloud instances use a Forgot password flow that emails a newly generated password, while...
PortSwigger's documentation for Burp Suite DAST describes built-in roles such as Administrator and Scan initiator, alongside custom roles that define sets of permissions matching team job functions. It warns that permissions like Modify settings or Manage...
PortSwigger's documentation for Burp Suite DAST states that the product manages user permissions through role-based access control, with users added either locally or through single sign-on. It says authentication is supported via the LDAP and SAML SSO...