Professional 1.4.02
Summary: PortSwigger released Burp Suite 1.4.02 on 12 October 2011, adding support for streaming HTTP responses so the Proxy passes data to the client as it arrives and Repeater updates in real time. The release also added an ECB Block Shuffler payload type in Intruder for testing ECB-encrypted tokens against block shuffling attacks, a new UI for specifying token locations in responses, improved extract grep, and custom parameter locations in session-handling macros.
Bottom line: The ECB Block Shuffler targets a specific weakness: because ECB ciphers encrypt identical plaintext blocks to identical ciphertext blocks, shuffling and duplicating ciphertext blocks can let an attacker alter a user ID or price inside an encrypted token, and success rises sharply when a large sample of tokens encrypted with the same key is available.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026