Introducing Burp Sequencer
Summary: PortSwigger announced Burp Sequencer, a preview tool for evaluating the randomness of session tokens and other data that will ship in the next Burp Suite release later this year. It captures tokens by repeatedly issuing a request and extracting the token from responses, allows analysis after 100 tokens, continues live capture to 20,000 tokens for FIPS-compliant statistical tests, and accepts manually loaded samples of 100 to 20,000 tokens.
Bottom line: The tool's verdict rests on significance-based statistical tests that report the effective entropy in a token, and it drills down to per-character and per-bit results - the same properties an attacker would study to predict session tokens.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026