Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

There are features like crawling and Audit 2. only Audit . How these options are different from active scanning and passive scanning

Sukhwinder | Last updated: Jun 18, 2021 02:08PM UTC

There are features like crawling and Audit 2. only Audit . How these options are different from active scanning and passive scanning

Ben, PortSwigger Agent | Last updated: Jun 21, 2021 09:08AM UTC

Hi, Performing a full crawl and audit means that Burp will firstly attempt to crawl the target site and discover the website content. Once this has been completed Burp will then audit the discovered content in order to try and identify any vulnerabilities present within the site. Essentially, with a full crawl and audit, you should be able to supply Burp with a starting URL (alongside authentication details, if required) and Burp should then be able to discover the content and then subsequently audit that content. The additional benefit in doing this is that Burp is 'path aware' in this mode of operation and, in terms of authentication, is able to rewalk paths in order to successfully audit content that is behind login functions without any additional user intervention. When performing active and passive scanning you are essentially carrying out auditing on existing, captured requests. Burp will simply carry out its auditing checks (for a passive scan only passive audit checks are carried out, for active scans you are testing against all of the default vulnerabilities) on the requests as they have been captured within Burp.

Sukhwinder | Last updated: Jul 01, 2021 07:04PM UTC

Please correct me if I am wrong. 1. Crawl and audit = crawl then active and passive scanning 2. Audit = Active and passive on already crawled elements 3. Active scanning and passive scanning =Audit So results should be the same if I run an only active scan and then passive sacn= only audit Please correct me if I understanding it in a worng way.

Ben, PortSwigger Agent | Last updated: Jul 02, 2021 12:39PM UTC