Professional / Community 2023.9.1
Summary: PortSwigger released Burp Suite Professional/Community 2023.9.1 on 10 August 2023, adding a Repeater single-packet attack that synchronizes parallel requests to arrive in full at the same time, based on James Kettle's Black Hat USA 2023 talk "Smashing the State Machine: The True Potential of Web Race Conditions." The release also adds HTTP/1 connection reuse in Intruder, a project-level Crawl paths tab in the Target tool, GraphQL introspection and endpoint guessing in Burp Scanner, and a startup setting to strip potentially harmful settings from untrusted project files.
What's compelling: Race-condition testing that once depended on network timing is now a built-in Repeater feature, so the window between two synchronized requests is something defenders should assume testers can hit deliberately rather than by luck.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026