Identifying high-risk functionality with Burp Suite - Port Swigger
Summary: PortSwigger's guidance describes using Burp Suite's Target site map and Proxy HTTP history to identify high-risk functionality while browsing a target website, so the tester can plan how to audit the application. It points to the deliberately vulnerable demonstration site ginandjuice.shop as a walkthrough target, and notes that items in the HTTP history can be sent to Burp Repeater for modification and further investigation.
Why it matters: The method depends on a tester browsing the application by hand and reading request and response traffic, which means the high-risk functionality gets found at the pace a person can map it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026