Scanner
The Scanner is Burp's automated vulnerability detection engine. It crawls the target application, submits test payloads, and analyzes responses for hundreds of known vulnerability patterns including SQL injection, XSS, SSRF, XXE, and the full OWASP Top 10.
Note: The Scanner is a Pro and Enterprise only feature. Community edition users must rely on manual testing with Repeater and Intruder, or use free extensions like Active Scan++ for some automation.
Scanner Modes
Burp Scanner operates in two distinct modes, each serving a different purpose:
Passive
Analyzes traffic without sending any requests. Only inspects requests/responses already captured by Proxy. Safe, zero risk of detection.
Active
Sends crafted requests to test for vulnerabilities. Can trigger alerts, log events, or cause errors on the target. Use only on authorized targets.
Running a Scan
From a Saved Request
In any tool tab (Proxy, Repeater, Intruder), select a request → right-click → "Scan selected requests". Or open the Scanner tab and manually add URLs.
Scanning the Entire Site
Use the Site map to select the target root folder → right-click → "Spider this host" or "Scan this host". Burp automatically discovers all content and tests each endpoint.
Configuring Scan Scope
Burp only tests URLs within the defined Target Scope. Set scope in Target tab before scanning to avoid hitting unauthorized hosts.
Customizing Scan Checks
In Scanner options, enable/disable specific vulnerability checks based on your target's technology stack (e.g., only test for SQLi if the app uses a database).
Info
Scan Results & Reporting
Scan results appear in the Scanner tab with an Issues table. Each issue includes:
Report Generation
Select issues → right-click → "Report selected issues". Export as HTML with full details for clients or internal documentation.
Issue Severity & Confidence
Burp scores issues by severity and confidence. Both matter for prioritizing work:
Critical
Immediate risk requiring urgent attention (e.g., unauthenticated RCE, SQLi with data dump).
High
Significant risk (e.g., stored XSS, authentication bypass, sensitive data exposure).
Medium
Moderate risk (e.g., missing security headers, verbose error messages).
Low
Minor issue or informational (e.g., HTTP cookie without HttpFlag, disclosed server version).
Info
Informational finding; may not indicate vulnerability.
Scanner Options (Pro)
Customize scan behavior in Scanner options:
Warning