Finding that one weird endpoint, with Bambdas
Summary: PortSwigger Research published a set of Bambdas - mini-extensions coded directly inside Burp Suite's proxy - that flag HTTP endpoints exhibiting unusual behavior, each of which flagged at least one real website. The examples include redirect responses with bodies over 1000 bytes, responses with multiple closing HTML tags, mismatched Content-Length headers, header names containing spaces (which surfaced servers running SMTP on port 443), and JSONP endpoints found by matching callback parameters reflected with an opening parenthesis.
What's compelling: The researchers say the whole collection took under an hour of R&D, and the mismatched Content-Length check alone exposed sketchy HTTP middleware injecting content into responses - a class of flaw that standard filtering in a large proxy history had missed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026