Burp Suite is a handy tool for many things, both security testing and development. Just being able to easily inspect and modify HTTP traffic is quite useful.

Despite all these useful functions, it is undeniable that the number one tool of Burp Suite, its crown jewel and flagship, is its scanner.

The scanner can perform vulnerability scans, where Burp tries to identify various vulnerabilities or weaknesses in the target, and crawling-type scans, where the tool tries to automatically map the paths and interfaces of the website.

Scans are initiated, monitored, and managed from the Burp Dashboard.

The top left pane contains all the current operations you have created. For example, if you create a new scan, it will appear here, where you can manage it. By default, BurpSuite Pro version performs passive mapping and auditing, but you can disable these if you want.

Now we will start the example lab below and run Burp's audit and mapping scan against it. If you are a member of Hakateemia, you can start the task below and proceed with it.

Find the command injection vulnerability in the lab and use it to read the 

Network modem - exercise

Open the application with a browser that is configured to work with BurpSuite software, for example, by opening Burp's built-in browser. Make sure that the application is visible in Burp by going to the 

, meaning include it in the current scope.

 window to display only the items contained in the scope by clicking the 

Now we should only see the desired target.

Vulnerability and mapping scanning (Crawl and audit)

Next, perform a basic audit and mapping scan on this target. Right-click on the target and select 

This should open a four-part window, where the first part determines the scanning type, as well as other details, such as targets.

 which means mapping and auditing scan. Then go to the 

Next, we can choose between two different options, which are to choose a preconfigured scanning configuration or create our own. There are also more preconfigured configurations available by going to 

Use a custom configuration -> Select from library.

scan on the first page. On the next page, we can specify the authentication-related actions more precisely, meaning providing ready-made credentials or stored login sequences. Nothing needs to be done for this right now.

Let's take a look at the last window, which is related to resources. The default setting for Burp is often very good and does not require adjustment, but occasionally it may be necessary to either increase or decrease resources as well as scanning speed. However, let's leave this as the default for now.

Select OK and the scanning source will start automatically. Go back to the 

 page. Now we can see that a new scanning operation is in progress and we can open it by pressing the arrow+window button on the right side of the operation.

It won't take long for BurpSuite to detect the command injection vulnerability in the task.

 sign in the top right corner of the window.

 page and investigate the vulnerabilities and deficiencies found during the scanning.

## What is the Burp Suite scanner?

Burp Suite is a handy tool for many things, both security testing and development. Just being able to easily inspect and modify HTTP traffic is quite useful.

Despite all these useful functions, it is undeniable that the number one tool of Burp Suite, its crown jewel and flagship, is its scanner.

The scanner can perform vulnerability scans, where Burp tries to identify various vulnerabilities or weaknesses in the target, and crawling-type scans, where the tool tries to automatically map the paths and interfaces of the website.

---

## Dashboard

Scans are initiated, monitored, and managed from the Burp Dashboard.

![](sanity:image-9d43eeab8c6a32d46d9213fc0d0920b3e1083c73-2860x1106-png)

The top left pane contains all the current operations you have created. For example, if you create a new scan, it will appear here, where you can manage it. By default, BurpSuite Pro version performs passive mapping and auditing, but you can disable these if you want.

---

## Using a Scanner - Practical Example

### Starting the exercise

Now we will start the example lab below and run Burp's audit and mapping scan against it. If you are a member of Hakateemia, you can start the task below and proceed with it.

@exercise 3f28f41bf0b0

### Opening Application with Burp Browser

Open the application with a browser that is configured to work with BurpSuite software, for example, by opening Burp's built-in browser. Make sure that the application is visible in Burp by going to the *Target *window.

![](sanity:image-1bac5ecf7a4081685aa0ce63ff6db9d4acd96eb4-1576x686-png)

### Setting the target to scope

Next, set the target *In-Scope*, meaning include it in the current scope.

![](sanity:image-4a17c1dba05e39f1b477c8928331c498ebed0f5e-1032x382-png)

Filter the *Target* window to display only the items contained in the scope by clicking the *Filter* button located at the top bar. Select *Show only in-scope items* as the filter. Then select *Apply*.

![](sanity:image-526990c53a1797ebbcd4137e711b52aef4c06f3b-880x572-png)

Now we should only see the desired target.

![](sanity:image-f17d42f895b75aa86a08f8391d820ae49cce7ee2-650x510-png)

### Vulnerability and mapping scanning (Crawl and audit)

Next, perform a basic audit and mapping scan on this target. Right-click on the target and select *Scan.*

![](sanity:image-3bcf0e0d6941536b139c1386fc2b55ff6ac1ad5a-548x362-png)

This should open a four-part window, where the first part determines the scanning type, as well as other details, such as targets.

![](sanity:image-87b3f1e61ae706be9954ce8bbd81c71bec7be79a-1490x788-png)

Select *Crawl and audit,* which means mapping and auditing scan. Then go to the *Scan Configuration* window.

### Scanning Configuration

![](sanity:image-60a45ce8e5c130c429c12966a3248ee9fb7eca56-1866x1288-png)

Next, we can choose between two different options, which are to choose a preconfigured scanning configuration or create our own. There are also more preconfigured configurations available by going to *Use a custom configuration -> Select from library.*

![](sanity:image-439d1b881b52525a276feefb11fe2cfb73f0670b-1520x1150-png)

However, we will choose the *Deep-*scan on the first page. On the next page, we can specify the authentication-related actions more precisely, meaning providing ready-made credentials or stored login sequences. Nothing needs to be done for this right now.

![](sanity:image-ba55fa3f7969989702aedcb0ceeed6a1e1e6ffd8-1220x698-png)

Let's take a look at the last window, which is related to resources. The default setting for Burp is often very good and does not require adjustment, but occasionally it may be necessary to either increase or decrease resources as well as scanning speed. However, let's leave this as the default for now.

![](sanity:image-d15734e432eef6148df1dfcc612af47398b235be-1200x854-png)

### Starting and monitoring the scan

Select OK and the scanning source will start automatically. Go back to the *Dashboard* page. Now we can see that a new scanning operation is in progress and we can open it by pressing the arrow+window button on the right side of the operation.

![](sanity:image-468b144458bc45c96474276893c945987ec6835d-1482x546-png)

It won't take long for BurpSuite to detect the command injection vulnerability in the task.

![](sanity:image-3593c4abc77229ebd0798aa3702ca3a688eb4d7f-2566x1200-png)

### Stopping the scan

Stop the scan by clicking on the *stop* sign in the top right corner of the window.

![](sanity:image-d7f4c7ad7f457a03b2d8c97df761119d1411b566-458x338-png)

### Reviewing scan results

Finally, return to the *Dashboard* page and investigate the vulnerabilities and deficiencies found during the scanning.

![](sanity:image-6e21259f1cd03973114173cabdb28f51b8ad4db1-1448x1444-png)


BurpSuite - Dashboard and scanning

BurpSuite is the leading web application security tool that facilitates identification and exploitation of vulnerabilities in web applications using various tools.

BurpSuite is a leading web application security tool that facilitates the identification and exploitation of vulnerabilities in web applications through various attack tools.

BurpSuite - Dashboard and scanning

What is the Burp Suite scanner?

Learn to hack — start here