Supporting Sprocket Security's offensive security testing with BChecks, from Burp Suite
Summary: PortSwigger published a case study on Sprocket Security, a US continuous penetration testing firm that uses Burp Suite Professional and Enterprise Edition and began experimenting with the BChecks scripting feature after tester Nate Fair saw a PortSwigger BChecks competition. The team learned the human-readable BChecks language at its fortnightly hackathon-style R&D meetups, and Director of Technical Operations Nicholas Anastasi initially misread the competition as a contest to produce the most BChecks in a set time, which led him to start generating them with ChatGPT - yielding multiple scan checks the team now uses inside Burp Suite.
Why it matters: A small pen-testing team picked up a new detection language in a few internal sessions and used a public chatbot to produce working scan checks, then planned to publish custom BChecks on GitHub - the same route your adversaries and your overstretched testers have to custom, reusable exploit logic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026