Cyber Risks · PortSwigger Research

Auto-Drop Requests

Summary: PortSwigger's BApp Store lists a third-party Burp Suite extension called Auto-Drop Requests, version 1.0.0a, authored by sunny0day and last updated on 10 February 2022. The extension automatically drops requests that match a specified regex, which the listing describes as helpful when a target has logging or tracking services enabled.

What's compelling: The extension is third-party code, and PortSwigger states it makes no warranty about its quality or usefulness, so a security team adding it to Burp is trusting an outside author's regex logic with control over which traffic reaches the target.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related