Enterprise Edition

Adding recorded login sequences

• Last updated: July 16, 2024

• Read time: 3 Minutes

Cloud Self-hosted

A recorded login sequence is a set of instructions that tell Burp Scanner how to log in to a particular web app. Recorded login sequences enable Burp Scanner to audit content that only authenticated users can usually see, even on web apps that use complex login mechanisms such as Single Sign-On.

This section explains how to add login sequences to a new or existing site. For information on how to record the sequences themselves, see Recording login sequences (Scanner).

Adding recorded login sequences to Burp Suite Enterprise Edition

You can add recorded login sequences when adding a new web app site. You can also add sequences to existing sites.

Add a recorded login sequence for a new web app

To add a recorded login sequence when you add a new web app site:

1. On the top menu, select Sites > Add a new site to display the Create a new site page.
2. In the Scan settings section, select Authentication > Application logins.
3. Select Recorded login sequences.
4. Click Add a recorded login sequence.
5. In the dialog box, enter a unique Label to identify this recorded login.
6. Paste the login script into the Paste script field.
7. Click Save.

Add a recorded login sequence for an existing web app

To add a recorded login sequence for an existing web app:

1. On the top menu, select Sites to display the site tree.
2. Select the web app site you want to set up notifications for.
3. Select the Details tab and click Edit.
4. In the Scan settings section, select Authentication > Application logins.
5. Select Recorded login sequences.
6. Click Add a recorded login sequence.
7. In the dialog box, enter a unique Label to identify this recorded login.
8. Paste the login script into the Paste script field.
9. Click Save to close the dialog box.
10. Click Save.

To add an additional recorded login, click the plus button and repeat steps 7 to 9.

To delete a recorded login, click the trash icon .

Reviewing a recorded login sequence

When you run a pre-scan check, Burp Suite Enterprise Edition captures images from your recorded login sequences. You can review the images from each sequence, to make sure that they successfully log in to the site.

To grant users permission to view recorded logins, an admin user needs to:

1. Create a new role that has permission to View sites, View site details, and View site application login details.
2. If the role also needs to enable users to run pre-scan checks, give permission to Edit sites and folders.
3. Create a new group that contains the new role, the appropriate users, and any site restrictions.
4. Ask the users to sign out and sign in again, for the changes to take effect.

To review your recorded login sequences:

1. From the Sites menu, select a web app site.
2. In the Health Status menu, click Run health check. Wait for the health check to complete.

3. Expand the Health status menu and go to the Recorded logins tab.

4. To review a specific recorded login sequence, click Review replay.
5. Review the images of the recorded login replay, to make sure that the login is successful.