What classes of vulnerability does manual Burp testing find that an automated DAST scan misses?
⚡
Quick Answer
Automated scanners are strong on injection and known misconfigurations but blind to logic.
Detailed Answer
Automated scanners are strong on injection and known misconfigurations but blind to logic. Manual testing with Repeater and Intruder finds broken access control (IDOR — changing an id to read another user's data), privilege escalation, flawed multi-step workflows, race conditions and price/quantity tampering. These need human understanding of intent, which is why compliance regimes still require periodic manual testing on top of automated scans.
Code Example
# Deep-dive: Burp Suite # Proxy/Repeater/Intruder workflow, scope configuration, authenticated testing, Burp Suite Enterprise for scheduled CI scans, and where manual testing finds what automated scanners miss (business-logic and auth flaws) # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about Burp Suite, not generic about "security".
burpdevsecopsdeep-dive