Scanner
Automated testing.
Scanner is a free Ethical Hacking Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Burp Scanner Overview
Burp Scanner (available in Burp Suite Professional) automatically crawls a web application and tests it for vulnerabilities such as SQL injection, XSS, and misconfigurations. It complements — never replaces — manual testing.
Crawl and Audit Phases
A scan has two phases. The crawl discovers content by following links and submitting forms to build a site map. The audit then sends crafted payloads to each discovered location to detect vulnerabilities.
Starting a Scan
Right-click a target in the site map and choose Scan, or start a new scan from the dashboard. You pick the scope (URLs to include) and a scan configuration that controls depth and aggressiveness.
Dashboard -> New scan
URLs to scan: https://target.local/
Scan type: Crawl and auditScan Configurations
Configurations tune the trade-off between coverage and speed/noise. Audit checks can be limited to passive only, light active, or thorough. Crawl limits cap how deep and how many links Burp follows.
Audit configuration:
- Passive only (no payloads sent)
- Light active
- Deep / thoroughPassive vs Active Scanning
Passive scanning only analyzes traffic already captured — it sends no extra requests, so it is safe and silent. Active scanning injects payloads, which can modify data or trigger side effects. Use active scans only with permission.
Authenticated Scans
Most interesting functionality is behind login. Provide Burp with session handling rules or recorded login sequences so the scanner stays authenticated and reaches protected pages.
Project options -> Sessions -> Add macro
Record login request sequence
Use cookie jar for session tokensReading the Issues List
Findings appear as issues, each with a severity (High/Medium/Low/Info) and confidence (Certain/Firm/Tentative). Burp includes the request/response evidence and remediation advice for every issue.
Severity and Confidence
Prioritize High severity + Certain confidence issues first. A "Tentative" finding needs manual verification before you report it — scanners produce false positives, and reporting noise damages credibility.
Verifying Findings Manually
Never trust a scanner blindly. Take a reported issue's request, send it to Repeater, and reproduce the vulnerability by hand. Confirm the payload actually triggers the behavior before including it in a report.
Issue -> Request -> Send to Repeater
# reproduce the injection manuallyLive Scanning vs Audit-Only
Burp can scan live as you browse (passive analysis of proxied traffic) or run a dedicated audit. Live passive scanning is great during manual exploration; a full audit is for thorough automated coverage.
Limits and Responsible Use
Automated scanning sends many requests and can corrupt data, trigger emails, or cause outages. Coordinate timing with the client, avoid production where possible, and never scan systems outside your authorized scope.
Quick Check
Test your Scanner knowledge.
Recap
You learned how Burp Scanner works:
- Two phases: crawl (discover) then audit (test)
- Passive = silent analysis, active = injects payloads
- Issues carry severity and confidence
- Always verify findings manually in Repeater to avoid false positives
Next: extending Burp with extensions.
Frequently asked questions
Is the “Scanner” lesson free?
Yes — the full text of “Scanner” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Scanner”?
Automated testing. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Scanner” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.