Introducing Burp Infiltrator
Summary: PortSwigger released Burp Infiltrator, a tool that instruments target web applications so Burp Scanner can detect when its input reaches potentially unsafe server-side APIs, a capability the company calls IAST (interactive application security testing). The initial release supports Java and other JVM-based languages such as Groovy, from Java 4 upward, with .NET support stated as a future addition.
Key Takeaway: The tool lets Burp correlate an external entry point, such as a specific URL and parameter, with the back-end code where a vulnerability occurs, which changes how a scanner finding can be traced to the line of code responsible.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026