Last updated: July 20, 2021
Read time: 2 Minutes
Browser-powered scanning is an invaluable feature that unleashes the full, unparalleled capability of Burp Scanner on modern websites and web applications. When browser-powered scanning is enabled, Burp uses its embedded browser to perform all navigation during both the crawl and audit phase of a scan. Navigating the target in this way enables Burp Scanner to accurately handle virtually any client-side technology that a modern browser can. This has the potential to offer dramatically increased coverage compared to the previous crawler engine.
Enabling browser-powered scanning also allows you to take advantage of several other new features that rely on the embedded browser to work. Most notably, you can record and upload full login sequences so that Burp Scanner is able to successfully handle more complex login mechanisms, including single sign-on.
Many users won't need to do anything to enable browser-powered scanning. When you launch Burp, it will automatically check your machine's specs. If it appears to meet the system requirements, all scans will use the embedded browser by default. Otherwise, scans will revert to the previous crawler engine.
If you prefer, you can also manually enable or disable browser-powered scanning in your scan configuration. You can find this option under "Crawling" > "Miscellaneous" > "Embedded browser options".
Browser-powered scanning does place slightly more load on your system resources than regular scanning. For this reason, we recommend a machine with at least 2 CPU cores and 8 GB RAM.
As a precaution, Burp's embedded browser is sandboxed by default. However, when running on Linux as
root, you may initially be unable to launch browser-powered scans.
If you run into issues, from the "Help" menu, open the "Embedded Browser Health Check" tool to see if this is the cause. If so, you can choose to allow the embedded browser to run without the sandbox. This option is available under "Project options" > "Misc" > "Embedded browser options". Before doing this, please make sure that you are aware of the security implications. Scanning hostile websites without the sandbox increases the risk of your local system being compromised.