Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's documentation describes the troubleshooting artifacts available for Kubernetes instances of Burp Suite DAST: a support pack containing diagnostics, integration logs, server and webserver logs for the last 10 days, and component metrics for...
PortSwigger's documentation for Burp Suite DAST describes a set of logging options and features intended to help its support team troubleshoot issues. The page notes that logs sent to support may contain sensitive information, and advises obfuscating that...
PortSwigger's documentation explains that Burp Suite DAST defines scan scope in two ways: Basic mode derives scope automatically from start URLs and lets you add or exclude URL prefixes, while Advanced mode requires regex rules covering every URL you want...
PortSwigger's Burp Suite DAST runs a pre-scan check when a new web app site is added, and it can be run on existing sites at any time. The check runs the URL connection check, attempts any recorded login sequences, and captures still images from those...
PortSwigger's documentation describes how Burp Scanner can be given a username and password so it logs in to a web app and audits content normally visible only to authenticated users. It recommends a recorded login sequence even for basic username and...
PortSwigger's Burp Scanner uses recorded login sequences - sets of instructions for logging in to a web app - so it can audit content only authenticated users can see, including apps with complex mechanisms such as Single Sign-On. The documentation...
PortSwigger's documentation describes how Burp Scanner can be given HTTP Basic and NTLM credentials at the platform level, so it authenticates automatically to destination web servers for all traffic to that host. Credentials are added when a site or...
PortSwigger's Burp Scanner documentation describes how users can view and manage individual steps in a recorded login sequence through a Steps tab, rather than editing the entire JSON script. Each step shows an action type and summary, and Click, Type, and...
PortSwigger documentation explains that adding authentication credentials for web app sites lets Burp Scanner discover and audit content only accessible to authenticated users. It states that only one login mechanism can be used per site, and that NTLM and...
PortSwigger's documentation describes how to add a web app site in Burp Suite DAST: users select Sites > Add a new site, choose Web app as the site type, enter a unique site name and Start URLs (no wildcards permitted), and pick a preset or custom scan...
PortSwigger's documentation describes how Burp Suite DAST configures API authentication for scanning, covering host credentials for fetching a hosted API definition file and API authentication for requests to endpoints during scanning. It supports basic...
PortSwigger's documentation describes how Burp Suite DAST populates an Endpoints tab from an uploaded API definition file, showing request name, HTTP method, SOAP operation, host, path and query, and content type. It states that all endpoints are selected...
PortSwigger's Burp Suite DAST documentation describes a bulk upload feature that creates a separate site for each API definition file or URL in a single operation, accepting a mix of Postman Collections, OpenAPI definitions, SOAP WSDL files, and Burp XML...
PortSwigger documented how Burp Suite DAST users can push API definitions into API finder through its GraphQL API when no built-in connector exists, covering OpenAPI and SOAP WSDL definitions and Postman Collections. Built-in connectors are provided for...
Burp Suite DAST can now connect to third-party platforms to automatically discover APIs deployed in an environment, with built-in integrations for Amazon API Gateway, Azure API Management, and Google Apigee. Discovered APIs appear in API finder, where...
PortSwigger's documentation describes how Burp Suite DAST lets users add a single API as a site by uploading a definition file, providing a URL, or importing captured traffic as a Burp XML or HAR file. Uploaded definition files are used for every scan...
PortSwigger's documentation describes how Burp Suite DAST scans APIs added by file upload or URL, supporting Postman Collections with optional environment files, captured traffic in Burp XML or HAR format, and GraphQL APIs with introspection enabled. It...
PortSwigger documents an unattended, command-line installation path for Burp Suite DAST on Linux and Windows, driven by a response.varfile generated from a prior manual install and passed to the installer with the -q flag. The page states each DAST server...
PortSwigger's documentation describes the site-level view in Burp Suite's DAST tool, where clicking a site opens tabs for a dashboard, scans, scheduled scans, issues, and details. The dashboard shows scan status and trend charts, including a New and...
PortSwigger's documentation describes how Burp Suite DAST attaches scan data to existing sites when a scan is triggered through the REST API's legacy "Burp scan" integration, and automatically creates a new site when no match is found. It states that these...
PortSwigger's documentation describes a scanning machine as a virtual or physical machine that runs Burp Suite DAST scans, with the installation wizard defaulting to running scans on the same machine as the DAST server and web server. That single-machine...
PortSwigger published a network and firewall rule reference listing the inbound and outbound access Burp Suite DAST needs across five deployment combinations: cloud or self-hosted instances, each running scans on PortSwigger's infrastructure, self-hosted...
PortSwigger's documentation describes how Burp Suite DAST administrators can enable TOTP-based multi-factor authentication for all users, requiring each user to scan a QR code and enter a 6-digit code from an authenticator app before logging in. The setup...
Burp Suite DAST assigns each issue a status that tracks where it sits in its lifecycle, with scanner-set statuses that users cannot change and separate statuses teams set to record their own assessment. An issue carries a single status at any time, and...
PortSwigger's Burp Suite DAST lets users create issue management rules that apply one decision about an issue to every matching issue on a site, setting status to False positive or Accepted risk or changing severity, and applying both to existing issues...
PortSwigger's documentation describes the Issues window in Burp Suite, where viewing an issue's details opens tabs that vary by issue type, with the Advisory tab always present. For DOM-based vulnerabilities, a Dynamic analysis tab shows results from an...
PortSwigger's documentation describes how Burp Suite DAST custom scan configurations let users set request throttling, crawl and audit behavior, NTLM and HTTP Basic authentication credentials, upstream proxy servers, and multiple client TLS certificates,...
PortSwigger's browser-powered scanning makes Burp Scanner use Burp's browser for all navigation during both the crawl and audit phases, letting it execute JavaScript to render dynamically generated UIs and trigger event handlers that modify requests on the...
PortSwigger's documentation explains that Burp Suite DAST's GraphQL API requires client-side JavaScript applications to allowlist their origin for cross-origin resource sharing, entering the URL scheme, domain name, and port in the Allowed Origins section....
PortSwigger's documentation describes how Burp Suite DAST lets users add or remove certificates so the tool knows which external systems to trust, including email or Jira servers, PortSwigger update sources, an internal certificate authority, or individual...