How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
Summary: During a four-plus-one pentest engagement, security analyst Ray Huygen used Burp AT to analyze a 66,000-line minified JavaScript bundle that he could not justify reviewing manually, and the tool found that whistleblower reports were protected only by a six-digit alphanumeric code. Huygen then had Burp AT run an Intruder attack that bruteforced the codes and exfiltrated the confidential reports, exposing a vulnerability that had been present for some time and missed in previous security assessments.
Bottom line: Confidential whistleblower reports were guarded by nothing more than a six-digit alphanumeric code, and the flaw survived prior pentests because no one could responsibly spend the time to find it - a malicious actor with the same patience could have reached those reports first.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026