Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

bWAPP Automated Scan

Stefan | Last updated: Dec 05, 2021 10:02AM UTC

Is there any benchmark against bwapp and DVWA? I am currently comparing various automatic DAST vulnerability scanners with DVWA and bWAPP In the test against bWAPP, Burp Professional could not crawl the approx. 140 subpages. I have set the authentication in such a way that when I open the browser within Burp I am automatically logged in, so it should also be able to crawl the 140 pages? Is it because of the structure of the website or are there parameters that I have forgotten BURP against bWAPP: High Certain 5 High Firm 1 High Tentativ 0 Total 6 Medium Certain 0 Medium Firm 1 Medium Tentative 0 Total 1 Low Certain 3 Low Firm 0 Low Tentative 2 TOtal 5 Information Total 394 Another Scanner like "Arachni" find over > 12 SQL Injections... Burp only one

Hannah, PortSwigger Agent | Last updated: Dec 07, 2021 05:10PM UTC

Hi Could you drop us an email at support@portswigger.net with some screenshots of your current scan configurations? We have a couple of options that you could possibly tweak to get better performance against these sites. Unfortunately, we don't benchmark against BWAPP or DVWA. You could check out WAVSEP if you're looking for any other vulnerable web applications to scan.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.