Cyber Security Academy · Lesson

Scanner and Extensions

Automate testing.

Scanner and Extensions is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Automating with Scanner

Burp's Scanner automatically tests an application for common vulnerabilities, freeing you to focus on the harder, manual logic flaws.

It is available in Burp Suite Professional and Enterprise editions, not Community.

Crawl and Audit

A Burp scan has two phases: crawl discovers the application's pages and inputs, and audit tests each discovered input for vulnerabilities.

You can run crawl only, audit only, or both.

Scan phases:
  1. Crawl  -> map URLs, forms, params
  2. Audit  -> test inputs for issues

Passive vs Active

Passive scanning only observes traffic you generate, so it is safe and silent. Active scanning sends crafted payloads and can change server state.

Use active scanning only against authorized, non-production targets when possible.

Starting a Scan

You can launch a scan from the dashboard with a URL, or right-click items in the target site map and choose 'Scan'.

Scope your scan tightly so it does not wander into out-of-scope systems.

Dashboard -> New scan
  URLs to scan: https://app.example.com
  Scope:        in-scope only

Reading Scan Issues

Findings appear in the Issue activity list with a severity and a confidence rating.

Confidence matters: a 'Firm' SQL injection is more reliable than a 'Tentative' one and should be verified first.

Issue                 Severity  Confidence
SQL injection         High      Firm
Reflected XSS          Medium    Certain
Clickjacking           Low       Tentative

Verify, Do Not Trust Blindly

Automated scanners produce false positives. Always reproduce a reported issue in Repeater before putting it in your report.

Your name is on the finding, not the scanner's.

What Scanners Miss

Scanners excel at pattern-based bugs but miss business logic flaws: broken access control, price manipulation, and workflow bypasses.

These require human reasoning, which is why a scan is a starting point, not the whole test.

The BApp Store

Burp's functionality extends through the BApp Store, a marketplace of community and official extensions inside the Extensions tab.

Extensions add new scan checks, decoders, and integrations.

Popular Extensions

A few extensions are near-essential for serious testing.

Logger++ for advanced request logging.
Autorize for automated access-control testing.
Active Scan++ for extra scan checks.
JSON Web Tokens for editing JWTs.

Writing Your Own

You can write custom extensions in Java, Python (via Jython), or Kotlin using the Montoya API.

Custom extensions let you automate logic specific to the application you are testing.

Extension APIs:
  - Montoya API (current)
  - Languages: Java, Python (Jython),
    Kotlin

Combining Automation and Skill

The expert workflow blends both: let the Scanner and extensions sweep for the obvious, then spend your time on logic flaws and verifying scanner output.

Automation widens coverage; human judgment finds the deep bugs.

Quick Check

Test your understanding of Scanner and extensions.

Recap

You learned to automate with Scanner and extensions.

Scanner crawls then audits; passive is safe, active sends payloads.
Issues carry severity and confidence; always verify in Repeater.
Scanners miss business logic flaws.
The BApp Store adds extensions like Autorize and Logger++.
Write custom extensions via the Montoya API.

Next you will run a full end-to-end web app test.

Frequently asked questions

Is the “Scanner and Extensions” lesson free?

Yes — the full text of “Scanner and Extensions” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Scanner and Extensions”?

Automate testing. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Scanner and Extensions” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy