Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

How to crawl sites with complicated logins with Burp Pro v2022.2

Michael | Last updated: Feb 23, 2022 01:44AM UTC

I'm using Burp Pro v2022.2. Doesn't seem like there's a way to automatically crawl a website with complicated logins. Both options in Application login do not work. It uses basic auth. I have tried both "User login credentials (username & password)" and "Use recorded login sequences (record using Burp's Chrome extension)". They both fail the login step. I have my own session handling rules and macros set up for login. Is there a way to use session handling rules and macros for crawling instead?

Michelle, PortSwigger Agent | Last updated: Feb 23, 2022 09:36AM UTC

Thanks for your message. If your site is using Basic Auth, have you tried configuring the authentication details under User Options -> Platform Authentication? Please let us know if this helps. If you're still having issues after trying this option can you send an email to support@portswigger.net with a few more details about the site and the login so we can take a closer look?

Michael | Last updated: Feb 24, 2022 12:29AM UTC

I'm using the scan launcher in an attempt to use the automatic crawl feature. I do have credentials filled out in User Options -> Platform Authentication but it doesn't seem to use it. It finishes crawling in a few seconds. I didn't work with the main URL by itself as our logins do this weird redirecting thing where you start from something like www.oursite.com -> login.oursite.com/randomlyGeneratedCharactersBaseOnMainURL -> www.oursite.com. login.oursite.com is where it'll pop up the basic auth. I didn't know the scan launcher would be able to use User Options -> Platform Authentication since it kept vetoing my session handling rules. Thanks for mentioning that, so I decided to add login.oursite.com into the list of URLs to scan and that worked. Now the scanner is able to crawl the main URL. Thanks!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.