Session Tracking Checks

Passively scans responses for references to known session replay and analytics services, flagging pages that load third-party scripts capable of recording user sessions.

Features

• Runs automatically as part of a passive scan, with no extra configuration needed.
• Checks against a list of known session tracking and replay domains.
• Raises a scan issue identifying the specific tracking domain found, so it can be reviewed alongside other findings.
• Highlights where a site may leak sensitive user input to a third party through session replay scripts.

Usage

1. Browse or crawl the target application as normal.
2. Let Burp's passive scanner process the responses.
3. Review any "Session tracking include" issues raised for pages that load a known tracking script.