Professional 1.6.35
Summary: Burp Suite Professional 1.6.35, released 21 January 2016, adds three new Scanner issues relating to HTTPS: unencrypted communications, mixed content, and strict transport security not enforced. The release notes say mixed content is reported when a page loads over HTTPS but pulls scripts and images over plain HTTP, and that missing Strict-Transport-Security lets a positioned attacker rewrite HTTPS links as HTTP.
What's compelling: The release notes cite mass interception of unencrypted communications by powerful adversaries as the reason for pushing HTTPS everywhere, and note that a suitably positioned attacker can strip SSL by rewriting HTTPS links as HTTP when HSTS is not enforced.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026