Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scan Targets behind CAS

Anup | Last updated: Jun 19, 2019 05:58PM UTC

Hi, I want to run the scanner on a target that is behind CAS. How do I setup authentication for this scenario? Thank you Anup

PortSwigger Agent | Last updated: Jun 20, 2019 09:42AM UTC

If you are manually crawling the application, you should be able to use Burp Scanner without modification with CAS. The requests that Burp captures in the Proxy will contain the required tokens from CAS. If you are trying to do a crawl & audit, this will be more difficult. You may have success if you include the CAS server within your scope. However, this can fail in some scenarios. We intend to add support for CAS and other federated identity providers in future.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.