Hands-On Application Penetration Testing with Burp Suite

Crawling

I want to emphasize here that Burp has an amazing crawling mechanism to map the site structure with the closest possible accuracy. Crawling may seem to be a simple task, but with modern dynamic applications it is not. As pentesters, we have always witnessed the scanners going in huge loops in the crawling phase due to the URL scheme implementations, and the scan never seems to finish, especially when you are testing a shopping cart. It is really frustrating when such things happen, because then you have to rely on completely manual strategies. Burp, on the other hand, has a very smart approach. The crawler of Burp mimics the way a user would browse the application on the browser. It simulates user clicks, navigation, and input submissions, ...