After this lesson, you will be able to: Understand Burp Scanner (Professional): passive vs active scanning, crawling, reading scan results (severity and confidence), tuning audit profiles, and the limits of automated scanning.
The Scanner is Burp's automated vulnerability finder, a Professional feature. This lesson covers passive vs active scanning, crawling, reading results, tuning, and crucially the boundary of what automation can and cannot find, so you treat it as a tool, not a replacement for skill.
Passive scanning analyzes traffic already passing through the proxy without sending extra requests; it finds issues visible in normal responses (missing security headers, insecure cookies, information disclosure) and is always safe to leave on. Active scanning sends crafted requests to probe for specific vulnerabilities (injection, etc.); it is intrusive and must only run against in-scope targets you are authorized to test.
Crawling is how Burp discovers application content by following links and forms; you configure the scope, depth, and login sequences so it can reach authenticated areas. Audit profiles control what the scanner tests for, letting you trade coverage against noise and speed, and reduce false positives. Tuning the profile to the target is what makes the Scanner useful rather than a flood of low-value findings.
Each issue has a severity (high, medium, low, informational) and a confidence (certain, firm, tentative), plus a description and remediation advice. Triage by severity and confidence together: a high-severity, certain finding is your priority; a tentative low is often noise to verify or dismiss. Always manually confirm a scanner finding before reporting it; automated tools produce false positives.
Pick one.
Running an active scan against an out-of-scope or unauthorized target. Reporting scanner findings without manual confirmation (false positives). Trusting the Scanner to find business-logic and access-control bugs (it cannot). Leaving a noisy default audit profile on a fragile app. Forgetting login sequences, so the crawl never reaches authenticated pages. Treating a clean scan as proof of security.
Sign in and purchase access to unlock this lesson.