Burp Scanner

Burp Scanner is PortSwigger's automated vulnerability scanning engine engineered to detect security flaws across complex web applications, single-page applications, and modern APIs. Operating as the core testing engine behind PortSwigger's enterprise security portfolio, Burp Scanner leverages dynamic application security testing (DAST) techniques to discover OWASP Top 10 vulnerabilities, including SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), XML external entity (XXE) injection, and insecure direct object references. The engine incorporates an embedded Chromium browser crawler capable of rendering heavy client-side JavaScript, navigating asynchronous frameworks, and executing authenticated crawl paths. Burp Scanner employs both active and passive scanning modes, utilizing advanced out-of-band application security testing (OAST) through the Burp Collaborator service to expose subtle vulnerabilities that do not produce immediate server responses, such as blind command injection and asynchronous SSRF. Development and AppSec teams can configure fine-grained scan configurations, customize attack insertion points, apply custom scan definitions, and throttle request concurrency to minimize server disruption. Detailed remediation guidance accompanies every finding, complete with reproducible proof-of-concept HTTP requests and response telemetry. By integrating Burp Scanner into continuous delivery pipelines, organizations automate the discovery of security risks, reduce manual testing bottlenecks, eliminate false positives, and ensure web applications remain resilient against emerging exploits.