Professional 1.5.20
Summary: Burp Suite release 1.5.20, dated 29 November 2013, adds support for nested insertion points to Burp Scanner, so that when an insertion point's base value contains data in a recognized format, Burp creates insertion points for each item of input at each level of nesting. PortSwigger's lab examples include SQL injection into a Base64-encoded value within a JSON value within a URL parameter, and XSS in an XML value within JSON within a URL parameter, with no stated limit to nesting depth.
Bottom line: The option is on by default and adds no overhead for conventional parameters, so the scanner now reaches input buried in Base64, JSON and XML layers that a single-level scan would leave untested.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026