Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Limit scanner payload base on known technology

Khanh | Last updated: Apr 25, 2024 07:19PM UTC

Is there any way I can limit the scanner payload If I know exactly which technology is used at the backend? For example: If I know the server uses Only PHP and MySQL (Ignore the case the data is sent to other systems with different technology), I would like the scanner to ignore all other injection payloads that are not relevant to PHP or MYSQL (for example: java deserialization payload, SQL injection for Oracle,..etc will be ignored)

Syed, PortSwigger Agent | Last updated: Apr 26, 2024 07:10AM UTC

Hi Khanh,

You can get a list of all the vulnerabilities that Burp scans for using this list: https://portswigger.net/burp/documentation/scanner/vulnerabilities-list

You can use this list to filter out the vulnerabilities that are relevant to you and then you can create a custom scan configuration in Burp where you can select only the scan checks relevant to you in the Auditing configuration under Issues Reported section.

I hope that helps.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.