Getting started with the site map
Last updated: September 14, 2023
Read time: 3 Minutes
The Target > Site map tab displays all the information that Burp gathers about websites. This information comes from a number of sources such as Burp Scanner, or URLs that you discover when you browse the target manually. The site map is a hierarchical tree that represents the site's content. This is organized into:
- Parameterized requests.
By default, Burp automatically populates the site map from the sites you visit using Burp's browser. We recommend following the tutorial below to learn how to use the site map as part of your testing workflow.
For more detailed information about the functions of the site map, please see the full documentation.
In this tutorial you'll learn about the main features of the site map, and how to use them in combination with other tools.
Step 1: Access the lab
Open Burp's browser, and use it to access the following URL:
Click Access the lab and log in to your PortSwigger account if prompted. This opens your own instance of a deliberately vulnerable website.
Step 2: Go to the site map
In Burp, go to the Target > Site map tab. Expand the contents of the node that represents the vulnerable lab website.
As you can see, Burp has already started to populate the site map.
Notice that some items are grayed out. Burp predicts that these items exist, but your browser hasn't completed a request-response cycle for them yet. This is probably because the URL appears in another response that you've received already.
Step 3: Update the site map
The site map updates automatically as you browse. If there's a particular grayed out item that you're interested in, you can copy the URL from the site map and paste it into Burp's browser.
Step 4: Filter the displayed information
The Site map tab contains various panels that show different information, such as the first request and response for each item. If you're using Burp Suite Professional, you'll also see a list of any security issues that Burp Scanner identifies.
Select a node in the site map. Notice that the information in the panels is now filtered based on the selected node.
Step 5: Set the target scope using the site map
The site map also makes it easy to set the target scope for Burp. Right-click on the top-level node for the lab and select Add to scope. When prompted to stop proxying out-of-scope traffic, click Yes.
You might want to exclude specific paths and subdirectories that you're not interested in from the scope. Right-click on the node for resources > images and select Exclude from scope.
Now go to the Target > Scope tab. You can see that the entire domain for the lab is in scope, but the /resources/images directory is excluded.
You can also delete any items that you're not interested in from the site map. These might be domains that were added before you set the scope. Select the items, right-click, and select Delete selected items.
Was this article helpful?
An error occurred, please try again.