Ultimate Burp Scanner Cheat Sheet: A Complete Guide for Web Application Security Testing

Introduction

Burp Scanner is a powerful automated vulnerability detection tool integrated within Burp Suite, a comprehensive web application security testing platform. It identifies security issues by analyzing web applications’ responses to various inputs and attack vectors. Whether you’re a penetration tester, security professional, or developer, this cheat sheet provides essential knowledge to effectively utilize Burp Scanner for identifying and addressing web application vulnerabilities.

Core Concepts

Key Components of Burp Scanner

Scanning Methodologies

• Crawl & Audit: Automatically discovers application content before scanning
• Point & Click: Scan specific functionality or endpoints
• Manual Application Mapping: User manually explores app, then scans discovered content
• API Scanning: Specialized scanning for API endpoints and services

Step-by-Step Scanning Process

1. Initial Setup

1. Configure your browser to route traffic through Burp Proxy
2. Ensure Burp Suite is updated to the latest version
3. Verify proxy settings (default: 127.0.0.1:8080)
4. Import/configure your Burp Suite license

2. Defining Scope

1. Navigate to Target → Site map
2. Right-click on target domain → “Add to scope”
3. Configure scope settings in Target → Scope
4. Set scan filter options to limit scan to in-scope items only

3. Configuring Scan Settings

1. Navigate to Scanner → Options
2. Select appropriate scan configuration based on objectives:
   • Crawl strategy: How deeply to crawl the application
   • Passive scanning: Enable/disable and configure
   • Active scanning: Configure attack insertion points and techniques
   • Issue reporting: Set severity thresholds and reporting options

4. Running a Scan

For Active Scanning:

1. Right-click on target URL/function in Site map, Proxy history, or Target tree
2. Select “Scan” or “Actively scan this [item]”
3. Configure scan settings in the dialog
4. Click “OK” to start scan

For Passive Scanning:

1. Enable passive scanning in Scanner → Options
2. Browse the application manually or use Burp Spider
3. Passive Scanner automatically analyzes traffic through proxy

5. Analyzing Results

1. Navigate to Scanner → Dashboard for overview
2. Review Issues tab for detailed vulnerability information
3. Prioritize by severity (High, Medium, Low, Info)
4. Validate findings to eliminate false positives

Key Techniques and Scan Types

Scan Types

Advanced Scanning Techniques

Content Discovery

Target → Site map → Select domain → Engagement tools → Discover content

• Configure discovery settings based on target complexity
• Include custom wordlists for better coverage

API Scanning

• Use Postman/Swagger imports for API definitions
• Configure correct content types and authentication
• Use sequence scanning for API flows

JavaScript Analysis

• Enable JavaScript analysis in Scanner options
• Set crawling depth to capture single-page applications fully
• Use the JS Miner extension for enhanced JavaScript parsing

Authentication and Session Handling

Setting Up Authentication

1. Configure in Project options → Sessions
2. Define authentication method:
   • Basic/NTLM authentication
   • Form-based login
   • Custom mechanisms via macros

Session Handling Rules

1. Navigate to Project options → Sessions → Session Handling Rules
2. Create rule with appropriate scope
3. Add actions (e.g., run macro, set cookie)
4. Test authentication flow before scanning

Common Authentication Configurations

Scan Configurations and Optimization

Performance Optimization

• Resource Pool Management: Configure in Project options → Connections
• Concurrent Requests: Adjust based on target application’s capacity
• Throttling: Set delays between requests to reduce impact
• Scan Queue Management: Prioritize critical functions

Scan Configuration Presets

Common Issues and Troubleshooting

Scan Performance Issues

Error Troubleshooting

Best Practices

Scanning Methodology

• Start Narrow: Begin with critical functionality before expanding scope
• Combine Techniques: Use both passive and active scanning
• Validate Findings: Always manually verify critical vulnerabilities
• Incremental Scanning: Scan in phases rather than all at once
• Document Everything: Keep detailed records of scan configurations and findings

Security and Ethical Considerations

• Obtain proper authorization before scanning
• Avoid heavy scanning during peak business hours
• Use throttling for production environments
• Respect scope limitations and data privacy
• Consider data protection implications of findings

Result Management

• Prioritize vulnerabilities by business impact, not just severity
• Group related issues for more efficient remediation
• Provide clear reproduction steps for development teams
• Track fixes and perform verification scans
• Maintain a vulnerability knowledge base for common findings

Advanced Features

Custom Scan Configurations

1. Navigate to Scanner → Scan configurations
2. Create new configuration or clone existing
3. Customize:
   • Attack insertion points
   • Payload selection
   • Request optimization
   • Issue reporting

Creating Custom Issue Definitions

1. Use the Burp Extender API
2. Develop custom scan checks in Java, Python, or Ruby
3. Integrate with existing scan engine
4. Publish to BApp Store or keep internal

Integration with CI/CD Pipelines

• Use Burp Suite Enterprise for automated scanning
• Leverage REST API for integration
• Set appropriate failure thresholds
• Incorporate into deployment decision gates

Common Vulnerability Checks

Resources for Further Learning

Official Documentation

• Burp Suite Documentation
• PortSwigger Web Security Academy

Community Resources

• Burp Suite Extensions
• OWASP Testing Guide
• PortSwigger Research

Training and Certification

• PortSwigger Certified Practitioner
• SANS SEC642: Advanced Web App Penetration Testing

Community Forums

• PortSwigger Forum
• r/burpsuite subreddit

Quick Reference Commands and Shortcuts