Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Determining software versions

Georgy | Last updated: Dec 09, 2021 08:50AM UTC

Hi I'm using the Enterprise version. Can you tell me why the scanner does not detect versions software? For example, the version of the web server? Why doesn't CVE show? I know that for the Professional version, i can install the Software Vulnerability Scanner plugin. But what about the Enterprise version? How to find, for example, Out-of-date Version (PHP) or Out-of-date Version (Nginx) and CVE? Please explain to me!

Uthman, PortSwigger Agent | Last updated: Dec 09, 2021 01:12PM UTC

Hi Georgy,

The Software Vulnerability Scanner extension is only compatible with Enterprise because it requires a GUI (using the Swing interface) and extensions with UI elements are not supported in Enterprise. If you have some programming skills, you could check out the code base and strip out the UI elements (e.g. Swing tables):


You can see all the scan issues that the scanner can detect by default here:


You can also create custom scan checks using an extension like Burp Bounty, Scan Check Builder or write your own using the sample extensions to help you.

Version detection like that you have described is not available in the scanner by default so a custom extension should help you out here.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.