Burp Suite Enterprise Edition is now available in our secure Cloud  –  Learn more

Live scanning

Dafydd Stuttard | 19 August 2018 at 15:56 UTC
MoBP Burp Suite

For a very long time, Burp has had two cool capabilities that are of huge value to manual testers:

The way that you do these things is changing, and getting a lot more powerful. In the new Scanner, these are called live scanning tasks.

One big change is that you will now be able to perform live scanning of traffic from other Burp tools, not just the Proxy. You can select which tools to monitor, the URL scope, and whether to deduplicate items:

There are two types of live scanning tasks, corresponding to the legacy features described above:

Another change with the new passive crawling is that you will have much finer-grained control over what gets added to the site map. Currently, Burp adds every single link that is found in responses. In modern web sites, this means that browsing a single page often causes Burp's site map to be polluted with dozens of uninteresting domains. You will now be able to configure exactly what gets added to the site map:

For example, you could tell Burp to add only links that belong to the same domain that was requested, or belong to any in-scope domain.

Another huge benefit of the new live scanning capability is that you can create as many distinct tasks as you like, each with a different scope and configuration. So you could, for example, create tasks to perform:

The possibilities here are endless, and we look forward to hearing your stories of what you have achieved with the new live scanning tasks.