Professional / Community 2021.7

Summary: PortSwigger released Burp Suite Professional and Community 2021.7 on 30 June 2021, adding DOM Invader, a tool that instruments the target's DOM, intercepts JavaScript sources and sinks, and places a definable canary string into sources to look for it in sinks. The release also improves Burp Scanner's navigation of single page applications by letting the embedded browser interact with more DOM elements that trigger JavaScript navigation, including anchor links and buttons, and adds a Learn tab with tutorials.
Key Takeaway: DOM XSS testing that once required manually tracing JavaScript sources and sinks is now automated through canary injection, and the SPA navigation changes widen the attack surface Burp Scanner can reach - so the client-side and JavaScript-triggered paths your own testing may have skipped are exactly where this tool now looks.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026