Professional / Community 1.7.20
Summary: PortSwigger released Burp Suite 1.7.20 on 6 April 2017, replacing its fuzzy response-diffing algorithm with granular diffing that separately analyzes attributes such as tag names, HTTP status code, line count, and HTML comments. The release also enhanced payloads for diff-based checks including SQL injection, LDAP injection, XPath injection, file path manipulation, and User-agent-, X-forwarded-for-, and Referer-dependent responses, and added per-host SSL certificates with the site's commonName in the subjectAlternativeName extension.
Key Takeaway: The update targets false negatives in blind injection detection, where a fuzzy whole-response comparison could miss a real vulnerability, and false positives where a web application firewall filters input matching or N=N and produces a different response than for or N=M.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026