Burp Suite User Forum

Create new post

Missing Security Headers Checks

Andrej | Last updated: Mar 03, 2021 08:29AM UTC

Hello, I'm running a licensed PRO version of Burp and in the current PoC scan/report, I can't find the evidence of these standard missing security-headers: - Content-Security-Policy - X-XSS-Protection - Referrer-Policy Would you please fix/add these? It's quite cumbersome to use Burp parallel with another free online checking tool, just to find the missing headers. Thank you, Andrej

Hannah, PortSwigger Agent | Last updated: Mar 03, 2021 10:42AM UTC

Hi Andrej Thank you for your message. You can find the full list of issues that Burp Suite checks for here: https://portswigger.net/kb/issues If there are some checks that you feel are missing, then you can create your own, either by writing an extension or using an already written extension. Extensions available on the BApp Store that you might find helpful are "Burp Bounty, Scan Check Builder" and "Headers Analyzer". Cheers Hannah Law Technical Product Specialist PortSwigger Web Security

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.