Burp Suite Professional - evolving the future of web security testing

Summary: PortSwigger's December 2020 post lists the features added to Burp Suite Professional during that year: browser-powered scanning using an embedded Chromium browser to crawl JavaScript-heavy apps, recorded login sequences via a browser plugin, API scanning for JSON and YAML APIs under the OpenAPI 3 specification in the 2020.11 release, message editor UI changes, cache poisoning checks based on James Kettle's BlackHat USA 2020 research, and experimental HTTP/2 support. The post states Burp Scanner is used by over 51k users and cites a Gartner prediction that by 2022 API abuses will be the most-frequent attack vector resulting in data breaches for enterprise applications.
Bottom line: The vendor's own citation puts API abuse on track to be the leading cause of enterprise application data breaches by 2022, and the scanning capability it describes covers only JSON and YAML APIs built to the OpenAPI 3 specification.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026