Hands-On Application Penetration Testing with Burp Suite
上QQ阅读APP看书,第一时间看更新

Why Burp Suite Scanner?

Now that we have established the basic understanding of how robust the Burp crawler is, it's time to understand why Burp Scanner is the go-to scanner for any pentest. Most traditional scanners usually fuzz the input fields, check the response, and determine if there is a vulnerability or not. But what if the application has certain rules, like, what if the application has enforced dynamic CSRF for every request? What if the application is a very dynamic application that serves different content for the same URL/page based on states, or what if the application invalidates the user on a malformed request? Worry not, because Burp already treats this differently and understands the underlying logic, enabling us with an optimized scan.