The top 10 community-created BChecks, so far ...
Summary: PortSwigger shortlisted ten community-created BChecks for Burp Scanner, scripted scan checks that let users build customized scans without advanced programming, and opened voting by Twitter like or GitHub thumbs up until midnight on 31 July. The shortlist was chosen on community popularity, ease of use, repo activity and creative ingenuity, and covers checks for issues including Apache mod_proxy request smuggling (CVE-2023-25690), Keycloak blind SSRF, NTLM authentication on non-standard directories, Nacos default passwords, exposed Prometheus metrics, JavaScript map files, and exposed SwaggerUI and OpenAPI endpoints.
Key Takeaway: These checks target the unglamorous exposures that show up in real environments - default credentials, reachable metrics endpoints, source maps and SwaggerUI - and they were written by practitioners rather than the vendor, which is a useful signal of where scanning gaps actually sit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-10774CVE-2021-27748CVE-2023-24488CVE-2023-25690
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026