Burp Suite, the leading toolkit for web application security testing

Scan Results

The Results tab contains all of the issues that the Scanner has identified, from both active and passive scanning.

There is a tree view showing a hierarchical representation of application content where issues have been found, with URLs broken down into domains, directories, and files. If you select one or more parts of the tree, all of the scan issues for the selected items are listed, with issues of the same type grouped together. You can expand these aggregated issues to view all of the individual issues of each type. 

If you select an issue, the relevant details are displayed, including:

Often, the fastest way to reproduce and verify an issue is to use the context menu on the message editor to send the request to Burp Repeater. Alternatively, for GET requests, you can copy the URL and paste it into your browser. Then you can reissue the request, and if necessary fine tune the proof-of-concept attack that was generated by Burp.

Every issue that Burp Scanner reports is given a rating both for severity (high, medium, low, informational) and for confidence (certain, firm, tentative). When an issue has been identified using a technique that is inherently less reliable (such as for blind SQL injection), Burp makes you aware of this, by dropping the confidence level to less than certain. These ratings should always be interpreted as indicative, and you should review them based on your knowledge of the application's functionality and business context.

The issue listing has a context menu that you can use to perform the following actions:

User Forum

Get help from other users, at the Burp Suite User Forum:

Visit the forum ›

Tuesday, November 18, 2014


This release contains various new features and enhancements.

The Scanner has been updated with the ability to detect cross-site request forgery vulnerabilities. The Scanner logic for the detection of XSS and SQL injection vulnerabilities has been further enhanced. Burp's use of temporary files has been updated to use a small number of large temporary files, rather than an individual file for each saved HTTP request and response.

See all release notes ›

Copyright © 2014 PortSwigger Ltd. All rights reserved.