Using Burp to Test for Components with Known Vulnerabilities - Port Swigger
Summary: PortSwigger's guide describes using Burp Proxy to capture a web application's HTTP history and read the Server name and version number from the response headers. That version information is then checked against central clearing houses such as CVE and NVD to see whether the web server has known vulnerabilities, with the BApp store's Software Version Reporter offered as a passive alternative.
What you should know: The technique depends on a server header that many applications expose by default, so an attacker can identify a weak component through scanning or manual analysis just as easily as a tester can - and the fix, upgrading or patching, only happens if someone checks.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026