There is a tree view showing a hierarchical representation of application content where issues have been found, with URLs broken down into domains, directories, and files. If you select one or more parts of the tree, all of the scan issues for the selected items are listed, with issues of the same type grouped together. You can expand these aggregated issues to view all of the individual issues of each type.
If you select an issue, the relevant details are displayed, including:
Often, the fastest way to reproduce and verify an issue is to use the context menu on the message editor to send the request to Burp Repeater. Alternatively, for GET requests, you can copy the URL and paste it into your browser. Then you can reissue the request, and if necessary fine tune the proof-of-concept attack that was generated by Burp.
Every issue that Burp Scanner reports is given a rating both for severity (high, medium, low, informational) and for confidence (certain, firm, tentative). When an issue has been identified using a technique that is inherently less reliable (such as for blind SQL injection), Burp makes you aware of this, by dropping the confidence level to less than certain. These ratings should always be interpreted as indicative, and you should review them based on your knowledge of the application's functionality and business context.
The issue listing has a context menu that you can use to perform the following actions:
Get help from other users, at the Burp Suite User Forum:
This release introduces the BApp Store, a repository of Burp extensions that have been written by users of Burp Suite, to extend its capabilities.
The handling of URL-encoding of parameters within session handling macros has been rationalized, to make Burp "just do" the right thing in nearly every case, without the need for any special configuration by the user.