Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Autheticated Scanning using Burpsuite

Devaraja | Last updated: May 17, 2021 10:06PM UTC

Hi, I believe you were supporting authenticated scanning during the Evaluation period for Burp suite Enterprise application. We tried to do security scanning using your tool but it didn't seem to do authenticated scanning. Could you please confirm if authenticated scanning is allowed? URLs Scanned: app-qa.clearlabs.com Email address: devaraja.amblelakshmana@clearlabs.com

Ben, PortSwigger Agent | Last updated: May 18, 2021 10:16AM UTC

Hi, Currently, there are two options available to you for authenticating against sites whilst scanning in Burp Enterprise. Firstly, you can use the traditional method of providing a username/password and Burp will try to determine, based on certain criteria, what it believe the login page is in order to try and login to the site using these credentials. The second method is to record a login sequence, which then gets replayed during the scan in order to login. This second option is a relatively new additional to Burp and has been designed to allow Burp to handle more complex login mechanisms. You can find out information about these two options on the following page: https://portswigger.net/burp/documentation/enterprise/working/sites/application-logins Both methods are applied at the site level within the 'Application logins' section.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.