Sample Burp Suite extension: custom scan insertion points
Summary: PortSwigger published a sample Burp Suite extension that registers as a provider of custom scanner insertion points, letting Burp Scanner place its payloads inside data formats it does not natively understand. The example uses a Base64-wrapped input format in which raw input is echoed unfiltered in the response, and the extension lets Burp's built-in scan checks find the XSS that automated scanning would otherwise miss. The download includes Java and Python source, a compiled JAR, and an ASP.NET page implementing the serialization format on client and server.
Why it matters: The article states that automated scanners generally will not identify input-based vulnerabilities when raw input must be embedded in an unsupported serialization format, leaving manual testing as the only option without a custom insertion point. Any application that wraps user input in its own encoding scheme is a blind spot for standard scan payloads until someone teaches the scanner the format.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026