Burp Scanner

Burp Suite includes Burp Scanner, an essential, enterprise-level tool for identifying various types of web vulnerabilities. It relies on a Crawler to build the website structure and a Scanner to perform passive and active vulnerability testing.

Note: Burp Scanner is a Pro-Only feature and is not available in the Community version.

1. Target Scope

Defining the scope ensures the scanner only processes intended targets, saving resources and preventing interaction with dangerous or out-of-bounds endpoints.

Starting a Scan

Scans can be initiated in the following ways:

• From Proxy History: Right-click a specific request and select Scan (for custom configuration) or Passive/Active Scan (for default configurations).
• From the Dashboard: Click the New Scan button to configure a scan on custom targets.

Managing Scope

• Navigate to Target > Site map to view all directories and files detected through the proxy.
• Include/Exclude: Right-click an item and select Add to scope or Remove from scope. Excluding specific items (e.g., logout functions) is critical to prevent terminating active sessions.
• Advanced Control: Navigate to Target > Scope to view details, specify regex patterns, or restrict Burp features strictly to in-scope items.

2. Crawler

The Web Crawler navigates a website by accessing links, submitting forms, and examining requests to build a comprehensive map of publicly accessible data.

• Scan Options: Burp provides two primary modes: Crawl or Crawl and Audit (which runs the vulnerability scanner after crawling).
• Limitation: A standard Crawl only follows referenced links. It does not perform directory fuzzing (like dirbuster or ffuf) to find unreferenced pages.
• Configuration: * Go to the Scan configuration tab to set crawl speed, limits, and behavior. Configurations can be custom-built or selected from predefined presets via Select from library (e.g., "Crawl strategy - fastest").
  • Authentication: Under the Application login tab, you can provide credentials or record manual login steps so the crawler can access authenticated areas of the application.
• Monitoring: Scan progress is tracked in the Dashboard tab under Tasks. Once complete, the updated structure is visible in Target > Site map.

3. Passive Scanner