Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Web Security Academy is a free online training center for web application security, with content from its in-house research team and Chief Swig Dafydd Stuttard, author of The Web Application Hacker's Handbook. It pairs written and video...
PortSwigger Research describes a technique for beating input length limits by spanning an XSS payload across multiple user-controllable fields that are reflected on the same returned page. In the Hackxor example, four input fields each capped at 10...
PortSwigger Research describes how attackers beat XSS filters that truncate input to a fixed maximum length by shortening payloads with the shortest available JavaScript APIs and by removing unnecessary characters. A second technique stores a larger...
PortSwigger Research describes a technique for beating length-limit filters on reflected XSS by injecting a 45-byte script, <script>eval(location.hash.slice(1)</script>, into a vulnerable parameter, which turns the reflected flaw into a DOM-based one. The...
PortSwigger's research on HTML sanitizing filters describes how applications HTML-encode key characters such as < and > or strip expressions like <script> to block cross-site scripting. It shows that filters replacing only the first instance, failing to...
PortSwigger's guide describes using the SQLiPy extension to connect Burp Suite with SQLMap, a standalone tool for identifying and exploiting SQL injection vulnerabilities. The workflow involves installing SQLiPy from the BApp Store, optionally starting the...
PortSwigger's article describes how to route Selenium browser-automation test traffic through Burp Suite, either by configuring the Selenium driver to proxy through Burp or by setting the proxy at the OS level. With interception turned off, Burp captures...
PortSwigger's tutorial describes using Burp Suite to test session token handling, noting that however well tokens are generated, an application is open to attack if tokens are handled carelessly, since a disclosed token lets an attacker hijack sessions...
PortSwigger's tutorial describes open redirections as vulnerabilities where a web application redirects to a location taken from user-supplied data, which an attacker could use for phishing or credential theft. It walks through using Burp's Proxy, Spider...
PortSwigger's guide describes using Burp Proxy to capture a web application's HTTP history and read the Server name and version number from the response headers. That version information is then checked against central clearing houses such as CVE and NVD...
PortSwigger's tutorial demonstrates detecting server-side code injection in Burp Suite using the OWASP NodeGoat training tool, where editing the afterTax parameter changed the response and entering 20 / 2 returned 10%. The walkthrough then shows the...
PortSwigger's tutorial walks through generating a proof-of-concept stored XSS exploit against a version of Mutillidae from OWASP's Broken Web Application Project, using Burp Proxy to capture a request, Repeater to inject a payload such as...
PortSwigger's article walks through exploiting a blind SQL injection bug found in an intentionally vulnerable training application, using Burp Intruder to cycle through pin numbers 0000-9999 and Grep-Match to spot the 'Account number is valid' response,...
PortSwigger's walkthrough shows how to detect subtle SQL injection by manipulating a URL parameter in Burp Repeater and watching how the response changes. In the examples, changing the 'id' value returns another user's details, entering 3-2 returns user 1,...
PortSwigger describes using Burp's invisible proxy listeners to test thick client applications that don't support HTTP proxies or offer an easy way to configure one. The technique redirects a non-proxy-aware client to Burp by modifying DNS resolution to...
PortSwigger published a tutorial on configuring a proxy-aware thick client application for testing with Burp Suite, noting that thick clients do most processing client-side and connect to the server only sporadically. The article explains that some thick...
PortSwigger Research describes SQL injection into the structure of a query rather than into a data value, where the attacker supplies valid syntax directly and no escaping is needed to break out of a data context. The most common structural injection point...
PortSwigger Research documents how signature-based XSS filters that match HTML components via regular expressions can be bypassed by altering case, using arbitrary tag names with event handlers, inserting NULL bytes, and substituting characters for...
PortSwigger's Burp Suite training FAQ page states that face-to-face training is delivered through training partners worldwide, with both public courses and training tailored to individual organizations, and that self-study options also exist. The page...
PortSwigger published a list of its top 10 Burp Suite extensions, selected by BApp store download popularity, PortSwigger Research team input, and user community feedback, updated December 2019. The extensions include Logger++, Autorize, Turbo Intruder...
PortSwigger describes Burp Suite as web application hacking software with over 50,000 users in more than 140 countries, built around Burp Proxy, a man-in-the-middle HTTP proxy that uses a self-signed CA certificate to view and edit encrypted HTTPS traffic....
PortSwigger's product page describes automated penetration testing as software that handles repetitive pentest work such as fuzzing, where large numbers of payloads are deployed and roughly 0.1% prove useful. It positions Burp Scanner inside Burp Suite...
PortSwigger describes DevSecOps as the integration of security into every stage of the software development lifecycle, building on DevOps by adding security to the development and operations pipeline rather than treating it as an afterthought. The guide...
PortSwigger is marketing Burp Suite DAST as a scanner that integrates directly into CI pipelines, automating security scans with each build and providing real-time feedback on security issues. The company cites a TechValidate survey of its customers saying...
PortSwigger's page on bug bounty tools cites a 2020 HackerOne report of over 3,000 respondents in which 89% of hackers said Burp Suite helps them most when hacking, ahead of Fiddler at 11% and WebInspect at 8.2%. The page describes Burp Suite's components,...
PortSwigger is marketing its Burp Suite automated web application security testing tools, including Burp Scanner and Burp Suite DAST, which it says contains the same scanner that sits at the core of Burp Suite Professional. The company claims its multi-AST...
PortSwigger is marketing Burp Suite DAST as an automated, scheduled dynamic scanning product whose concurrent scan model it describes as indefinitely scalable across internal and external applications, websites, and URLs. The page cites a TechValidate...
PortSwigger Research describes an annual project, started by Jeremiah Grossman and Matt Johansen in 2006, in which the infosec community and a cross-company panel of experts select the top 10 web hacking techniques of each year. The project ran on...
PortSwigger Research describes template injection, where user input is allowed to define template expressions, split into client-side template injection (CSTI) in the browser and HTML and server-side template injection (SSTI) in server languages such as...
HTTP request smuggling is an attack technique that sends ambiguous HTTP requests which front-end servers interpret as different lengths, causing them to desynchronize and merge requests and responses between attackers and legitimate users. PortSwigger says...