Cyber Risks · PortSwigger Research

Professional / Community 1.7.10

Summary: PortSwigger released Burp Suite Professional/Community 1.7.10 on 2 November 2016, adding two APIs to IExtensionHelpers that let extensions analyze collections of responses for variations in attributes and for keyword occurrence counts. The release notes say the new APIs let Burp handle response diffing so extensions can build scan checks with simple logic, and an extension demonstrating them was slated for the BApp Store on Friday to coincide with the Backslash Powered Scanning talk at Black Hat EU.

What's compelling: The tooling that decides whether two responses differ is now handed to the scanner itself, so the quality of your custom scan checks depends on trusting Burp's attribute and keyword comparison logic rather than your own.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related