Professional 1.6.08
Summary: Burp Suite Professional 1.6.08, released 18 November 2014, adds Scanner detection for cross-site request forgery (CSRF), which PortSwigger says it deliberately tuned to reduce false positives so reported issues warrant manual investigation. The release also enhances XSS and SQL injection detection logic, switches temporary file handling to a small number of large files, raises the maximum Spider and Intruder thread count to 999, and adds a configurable hotkey to start the current Intruder attack.
Bottom line: PortSwigger's stated reason for holding back CSRF detection was that noisy scanners train users to ignore a whole issue type - a reminder that false positive volume, not missed findings, is what erodes trust in the tooling your testers rely on.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026