[MoBP] Search me
Summary: PortSwigger added a suite-wide search function to Burp Suite that lets users enter an expression and search request headers, response bodies, specific tools, or everywhere, with matches shown in a sortable table and a preview pane showing full requests and responses with highlighted hits. The post describes using it to test whether credit card numbers were masked after initial submission, and the search found a couple of obscure locations where the number was transmitted to the client within HTML source even though it was masked everywhere on-screen.
What you should know: The masking held on-screen but not in the HTML source, so a control that looks correct in the browser can still ship the full card number to the client - and only searching the raw responses surfaces it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026