Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

burp scanner for responses

Gabriel | Last updated: Aug 29, 2018 07:53AM UTC

Hello, I would like to know how it is possible also use the capabilities of the Scanner for the intercepted responses. I would like to scan also the client application not only the server. Besides, I updated for the latest 2.0.1 version, where I could not find anything related to this. Thanks.

PortSwigger Agent | Last updated: Aug 29, 2018 09:45AM UTC

There are two parts to the Scanner - Active and Passive. Passive scan is automatically run on responses. However, Active scan only works with requests - it's design is based on adding payloads to the request, sending it to the target server, and observing the response. For scanning client applications, for the specific case of HTML5/JavaScript clients Burp 2 has strong built-in support: - https://portswigger.net/blog/dynamic-analysis-of-javascript For other clients, Burp can help you, but you still need to do a lot of manual work. For example, you can Intercept responses from the server, modify them, and observe how the client behaves.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.